RavenHawkTech LLC

Tailscale on pfSense: Accessing Devices on the WAN Subnet

Dark firewall and secure mesh tunnel illustration for Tailscale access to WAN-side devices.

One of the more common advanced networking scenarios with Tailscale on pfSense is allowing remote Tailscale clients to access devices located on the WAN-side subnet of the firewall. While this sounds straightforward, pfSense treats WAN traffic differently than LAN traffic, which can lead to confusion when routing traffic back out the WAN interface.

This guide walks through the configuration that solved the issue, including outbound NAT, firewall rules, and common troubleshooting pitfalls.

This article is part of the Ultimate Self-Hosting Guide and Virtualization & Homelab cluster, where RavenHawkTech covers private infrastructure, remote access, home networks, pfSense, VPN overlays, and practical troubleshooting.

Why This Scenario Is Different

Normally, pfSense routes traffic between interfaces such as:

  • LAN to WAN
  • VLAN to LAN
  • VPN to LAN

However, when traffic enters through Tailscale and then exits back out the WAN interface toward the WAN subnet itself, pfSense behaves more cautiously. This often requires both explicit firewall permissions and outbound NAT configuration.

Key point: The route advertisement tells Tailscale where to send traffic, but outbound NAT is often what makes the return path work for WAN-side devices.

Example Network Layout

  • pfSense WAN: 10.0.0.2/24
  • Upstream Gateway: 10.0.0.1
  • Tailscale Network: 100.x.x.x
  • Goal: Allow Tailscale-connected clients to access devices on 10.0.0.0/24

Step 1: Advertise the WAN Subnet in Tailscale

Inside the Tailscale configuration on pfSense, advertise the WAN subnet:

10.0.0.0/24

After enabling the route:

  1. Open the Tailscale admin console.
  2. Navigate to Machines.
  3. Approve the advertised subnet route.

Without approving the route, Tailscale clients will not send traffic through pfSense for that subnet.

Step 2: Configure Firewall Rules

A firewall rule is required on the Tailscale interface.

Recommended Rule

  • Interface: Tailscale
  • Action: Pass
  • Protocol: Any
  • Source: Tailscale networks
  • Destination: WAN subnets

This explicitly permits traffic from Tailscale clients to reach the WAN-side network.

Step 3: Configure Outbound NAT

This is the critical piece in many pfSense and Tailscale WAN-subnet access scenarios.

In most cases, devices on the WAN subnet do not know how to route traffic back to Tailscale addresses such as 100.x.x.x. To solve this, outbound NAT must translate the source address to the pfSense WAN IP.

Navigate to:

Firewall → NAT → Outbound

Switch the outbound NAT mode to:

Hybrid Outbound NAT

Create a rule with the following settings:

  • Interface: WAN
  • Source: Tailscale networks
  • Destination: WAN subnets
  • Translation: WAN address

This causes traffic to appear as though it originated directly from the pfSense WAN IP instead of the remote Tailscale client.

Why NAT Matters

Without outbound NAT:

  • Traffic reaches the WAN-side host.
  • The host replies to the 100.x.x.x Tailscale address.
  • The upstream network has no route back.
  • Communication fails.

With NAT enabled:

  • The WAN-side host sees traffic from the pfSense WAN IP.
  • Replies naturally return to pfSense.
  • pfSense forwards the responses back through Tailscale.

Additional Troubleshooting Tips

Disable Private and Bogon Blocking

If the WAN interface uses RFC1918 addressing, pfSense may silently drop traffic depending on the WAN interface settings. Common private address ranges include:

  • 10.x.x.x
  • 192.168.x.x
  • 172.16.x.x

Go to:

Interfaces → WAN

Disable the following options if they apply to your environment:

  • Block private networks
  • Block bogon networks

Check NAT Rule Order

In Hybrid NAT mode, rules are processed from top to bottom. Make sure the custom Tailscale NAT rule is above automatically generated outbound NAT rules where necessary.

Verify with Packet Capture

The quickest way to confirm traffic flow is to use pfSense packet capture:

Diagnostics → Packet Capture

Capture on the WAN interface.

If NAT is functioning correctly, outbound packets should appear with the source set to the pfSense WAN IP.

If packets still show the source as 100.x.x.x, then the NAT rule is not matching.

Troubleshooting note: If route approval, firewall rules, and NAT all appear correct, test with packet capture before changing multiple settings. It is much easier to fix the rule that is not matching than to troubleshoot several changes at once.

Testing Beyond Ping

Some upstream devices block ICMP or behave strangely with indirect routing. Instead of relying only on ping, test real services such as:

  • SSH
  • RDP
  • HTTP
  • HTTPS

Final Thoughts

Once the firewall rule and outbound NAT rule are both correctly configured, access to WAN-side devices from Tailscale clients should work reliably.

The biggest takeaway is that WAN-subnet access behaves differently than traditional LAN routing on pfSense, especially when VPN overlays such as Tailscale are involved. Proper outbound NAT is usually the key to making the setup function consistently.

Related Homelab Reading