I actually did this instead of tailscale first; installing tailscale on a pfsense router was a challenge, iirc i had to find and install the freebsd tailscale pkg from the command line because the plugin doesn’t give the option to connect to a non-tailscale control plane.

After I did that and connected to my headscale server, I could ping pfsense’s local ip, but couldn’t get any traffic out. Turns out I had forgotten the pfsense tailscale plugin automatically sets up outbound rules for you.

That was a rabbit hole I didn’t feeling like falling down, so I turned off headscale and just used tailscale. But it’s there and it does work fine if I ever wanted to go figure out the outbound traffic rules.