Why do I need TS installed on pfsense router?
-
Assuming I don't plan to access my firewall pfsense directly from the open internet and want only to access some boxes where I have TS clients installed, why do I even need TS on my router?
Happy New Year all!
-
@chudak Why do you? There is no reason to install tailscale on pfsense if you don't want it to participate in some tailscale network, Or want to allow it to be used to connect behind pfsense via tailscale to stuff that doesn't have tailscale installed.
-
@johnpoz said in Why do I need TS installed on pfsense router?:
@chudak Why do you? There is no reason to install tailscale on pfsense if you don't want it to participate in some tailscale network, Or want to allow it to be used to connect behind pfsense via tailscale to stuff that doesn't have tailscale installed.
Yes exactly
Thx for your opinion
What do you think about accessing the pfsense router via TS IP? Secure? And if yes how would you enable it?
TIA
-
@chudak I have TS setup with pfsense, but other then testing that it works I would normally just access via openvpn.
I am not aware of any security concerns with TS at this time.. What do you mean how would I enable it - I walk through the TS gui on pfsense, it was pretty straight forward..
-
@johnpoz said in Why do I need TS installed on pfsense router?:
@chudak I have TS setup with pfsense, but other then testing that it works I would normally just access via openvpn.
I am not aware of any security concerns with TS at this time.. What do you mean how would I enable it - I walk through the TS gui on pfsense, it was pretty straight forward..
When hit TS pfsense IP the UI page does not start
Maybe there is a setting somewhere
️ ? -
@chudak let me test from my phone on cell with tailscale - brb.
An intelligent man is sometimes forced to be drunk to spend time with his fools
If you get confused: Listen to the Music Play
Please don't Chat/PM me for help, unless mod related
SG-4860 24.11 | Lab VMs 2.8, 24.11 -
@chudak ok back - I had some issues with pfblocker doh list blocking my access to the TS site.. anywho.. Got that sorted, and then could enable routes and exit node stuff again on TS site, seems when got disconnected while back for expired keys when I brought it back up it looked like new device which didn't have routes enabled, or exit node.
So got that sorted then was able to access my pfsense web gui from phone on cell, connected to TS just using the lan IP of my pfsense 192.168.9.253 and my gui port
-
@johnpoz
In my case I am trying to use TS IP: 100.xx.yy.35 and I can't either from my net of outside -
@chudak why would you use that? But I just tried that.. And worked after it complained about the cert.
BTW there really no point to hiding the TS Ips - they are all in the cgnat space.. If your not connected to ts they sure would not route.. And pretty sure they don't allow people on different TS networks that have been setup to see each other - unless they have some way to allow for that..
An intelligent man is sometimes forced to be drunk to spend time with his fools
If you get confused: Listen to the Music Play
Please don't Chat/PM me for help, unless mod related
SG-4860 24.11 | Lab VMs 2.8, 24.11 -
@johnpoz What theme is that?
-
@michmoor theme where on pfsense screenshot from phone? I am using default pfsense theme
-
@johnpozah ok. Looks different to me
-
@michmoor maybe browser setting on my phone? Just using firefox on an iphone.. I think I set it to dark or something - not a big browser on my phone guy anyway.. I mean I look up stuff like anyone and go to the site.. But not a big just surfing about to stuff so have not spent any time trying to make it look pretty or anything ;) heheh
-
I see
tailscale0 Default deny rule IPv4 (1000000103)Blocking access to my router via TS
I have no WF rules on tailscale0 interfacePuzzled
I do see WG port open.
Do I need to open port for TS too?
-
@chudak you mean on this interface you have no rules?
-
@johnpoz said in Why do I need TS installed on pfsense router?:
@chudak you mean on this interface you have no rules?
I do not.
What’s interesting that except opening pfsense UI everything else is working fine
️PS: WG interface also has none
-
@chudak so you can get to your other devices though pfsense TS connection.. Or do the clients have their own TS connections?
I could try removing that rule and see if I can still get to the web gui.. There for sure some hits on it - but not very much.. but then all I did was open the webgui page, I didn't log in or anything.
I will set that rule to log as well to see what it actually allows.
-
@johnpoz said in Why do I need TS installed on pfsense router?:
@chudak so you can get to your other devices though pfsense TS connection.. Or do the clients have their own TS connections?
Both work fine
BTW I trued adding this rule and it didn't make any difference
-
@chudak that rule is what seems to allow it - here I set it to log, and made a connection via my phone and you can see it showing a state
Did you try just access say your webgui on your pfsense lan IP?
An intelligent man is sometimes forced to be drunk to spend time with his fools
If you get confused: Listen to the Music Play
Please don't Chat/PM me for help, unless mod related
SG-4860 24.11 | Lab VMs 2.8, 24.11 -
@johnpoz said in Why do I need TS installed on pfsense router?:
@chudak that rule is what seems to allow it - here I set it to log, and made a connection via my phone and you can see it showing a state
Did you try just access say your webgui on your pfsense lan IP?
I can access via LAN IP
Added this rule and see what you see:
So it passed, buy still no UI
So I am suspecting it's something else on pfsense level
