Messages

PR created, for reference: https://github.com/opnsense/plugins/pull/4490

Thanks ben! your patch fixed my issue. Looking forward to the PR

I am using the tailscale plugin. My issue is not with connecting to the headscale server.

OPNsense version: 24.7.12
Tailscale plugin version: 1.1

When rebooting my opnsense vm instance, the boot hangs at this point in the process:

Code Select Expand

Warning: Subnet routing and exit nodes only work with additional manual configuration on freebsd, and is not currently officially supported.
setup vtnet0 [egress only]
setup vtnet2
setup vtnet1

I believe this is because my tailscale vpn is connected to a self-hosted headscale instance that is behind the opnsense vm. When opnsense boots, it cannot reach the control server, so it hangs trying to bring the interface up.

I tested this by disabling tailscale and rebooting, and the boot completes without any issue. I also tested by configuring a connection to the main tailscale control server, and the boot also completed without issue. Here are the logs when connecting to the tailscale control server:

Code Select Expand

Warning: Subnet routing and exit nodes only work with additional manual configuration on freebsd, and is not currently officially supported.
tun0: changing name to 'tailscale0'
tun0: link state changed to UP
setup vtnet0 [egress only]
setup vtnet2
setup vtnet1

Is there a way to manually bypass this check so the boot can complete? This only recently became an issue with my setup.

I followed the documents in selectively routing hosts through a wireguard external vpn, https://docs.opnsense.org/manual/how-tos/wireguard-selective-routing.html , but I cannot get the routing to work at all. Traffic still gets routed through the default WAN gateway. I cannot figure out what is going wrong.

I know my VPN connection works because I can make a simple road warrior configuration work. However, it routes ALL internet traffic through the VPN because a route is automatically created for 0.0.0.0/1.

My basic setup:
PROTON is the interface for the wireguard tunnel,
ProtonVPN is the gateway name,
ProtonVPN_Hosts is the alias for the hosts intended for the tunnel and includes the IP network for 100.64.0.1/24
HSC is the interface I want hosts to be able to access the tunnel from

Attached are screenshots of my configuration. I appreciate any help!