Setting up Tailscale

[opnsensehey]

Hello.

I'm following this guide from the Tailscale KB to get OPNsense connected to my tailnet:

https://tailscale.com/docs/install/opnsense

I'm stuck on this part: https://tailscale.com/docs/install/opnsense#static-nat-port-mapping

It says to make these rules but I'm not seeing how I set source and destination ports to simply be "UDP" as I only see an option for setting a specific individual port or port range:





It also mentions an ACL change but I'm stumped on where I change that.

Any help would be greatly appreciated. Thank you! :)

[IsaacFL]

It says on the link you

Code Select Expand

As of OPNsense v24.711, an os-tailscale community plugin is available.
It can be installed through the GUI. System > Firmware > Plugins. Check the box Show community plugins.
This plugin does not require any of the following command-line steps.
It's been a while but I just installed the plugin. I didn't do anything to NAT but I did set some firewall rules.

[nero355]

I'm not seeing how I set source and destination ports to simply be "UDP"

That might be outdated information since this can be done now : https://forum.opnsense.org/index.php?topic=52419.msg275740#msg275740

Read some posts before that one too if you want to know more about it ;)

[mimugmail]

Best is to watch the youtube videos of Sam Sheridan (author of the plugin)

[opnsensehey]

It says on the link you

Code Select Expand

As of OPNsense v24.711, an os-tailscale community plugin is available.
It can be installed through the GUI. System > Firmware > Plugins. Check the box Show community plugins.
This plugin does not require any of the following command-line steps.
It's been a while but I just installed the plugin. I didn't do anything to NAT but I did set some firewall rules.

What firewall rules?

I thought I was explicit in my post about the firewall rules -- that is, that the document shows the rules to be made but the settings in the latest version of OPNsense seem to have different settings. I may not have explained it clearly enough though.

[opnsensehey]

I'm not seeing how I set source and destination ports to simply be "UDP"

That might be outdated information since this can be done now : https://forum.opnsense.org/index.php?topic=52419.msg275740#msg275740

Read some posts before that one too if you want to know more about it ;)

I'm not seeing how I set source and destination ports to simply be "UDP"

That might be outdated information since this can be done now : https://forum.opnsense.org/index.php?topic=52419.msg275740#msg275740

Read some posts before that one too if you want to know more about it ;)

Appreciate the link :) though I'm confused on what I'm supposed to do with this. Looks like this link is for setting up UPNP. I'm hoping to skip UPNP as this is intended for a corporate environment and while UPNP is awesome at home, I was always under the impression that there's some security implications with using it and thus it's not advised for environments where security is important.

Mind you, if I'm wrong, I'm happy to be corrected. :) On the flip side, that post is awesome for helping me get some UPNP going at home. Ha! ...so thanks again!

[nero355]

Appreciate the link :) though I'm confused on what I'm supposed to do with this. Looks like this link is for setting up UPNP.

It's basically the new way to setup Strict-port NAT by splitting the TCP and UDP part of it :
- Enpoint-Independant NAT Rule for UDP traffic.
- Strict-port NAT Rule for TCP traffic.

My guess is that the TailScale Documentation has not been updated to cover it so "Results may vary" but I suggest you give it a try :)

I'm hoping to skip UPNP as this is intended for a corporate environment and while UPNP is awesome at home, I was always under the impression that there's some security implications with using it and thus it's not advised for environments where security is important.

I am 100% Anti-uPnP too and that's why I have setup things as described above for all my Clients that might need it : Gaming/Video calls/other P2P stuff...

On the flip side, that post is awesome for helping me get some UPNP going at home. Ha! ...so thanks again!

LOL! :)