Bitdefender Firewall blocking TCP traffic over Tailscale virtual adapter despite explicit allow rule

Hello Bitdefender Support Team,

I am reporting a reproducible incompatibility between Bitdefender Firewall on Windows and Tailscale, and I would appreciate guidance on whether this is expected behaviour, a misconfiguration on my side, or a known limitation.

Summary of the issue

When Bitdefender Firewall is enabled, TCP traffic over a Tailscale virtual network adapter consistently fails (timeouts), even though ICMP and UDP traffic work and even though explicit application- and port-based allow rules are configured. Disabling only the Bitdefender Firewall immediately resolves the issue.

Environment

Windows 11 (64-bit)
Bitdefender (current consumer version, Firewall enabled)
Tailscale (latest stable Windows client)
Remote peer: Linux (Raspberry Pi), confirmed reachable and accepting connections

Observed behaviour

ping <tailscale-ip> works intermittently or initially
UDP traffic (Tailscale peer-to-peer) works
TCP connections (e.g. SSH on port 22, HTTPS on port 443) time out
Test-NetConnection <tailscale-ip> -Port 22/443 fails with TcpTestSucceeded : False
As soon as Bitdefender Firewall is disabled (all other protections left enabled), TCP connections work immediately

Verification on the remote host

On the Linux peer, I verified that:

The services are listening on 0.0.0.0 and on the Tailscale IP
Local connections to the Tailscale IP succeed
Firewall rules on the Linux side explicitly allow traffic on the Tailscale interface

This strongly suggests the traffic is being blocked on the Windows side.

Configuration steps I attempted in Bitdefender

I followed common guidance (including Bitdefender community advice) and tried the following:

1. Firewall application allow rules

Added tailscale.exe and tailscaled.exe as Allowed applications
Network type: Any / Private / Trusted
Protocol: Any

2. Explicit firewall port rules

I added explicit Allow rules (both outbound and, in some cases, both directions) for:

UDP 41641 (Tailscale peer-to-peer)
UDP 3478 (STUN/NAT traversal)
TCP 443 (HTTPS over Tailscale)
TCP 22 (SSH over Tailscale)
(Optionally) TCP 139 and 445 for SMB

I am not fully certain whether Bitdefender expects these to be outbound-only or both directions, but I tested both configurations with no change in behaviour.

3. “System” traffic

I also created rules for the built-in System application (rather than only tailscale.exe), as TCP traffic appears to be system-owned.

4. Advanced Threat Defense

Added an Advanced Threat Defense exception for tailscaled.exe

5. HTTPS inspection

Kept Encrypted Web Scan enabled globally
Added exceptions for:
- *.ts.net
- the specific Tailscale hostname
- the Tailscale CGNAT range 100.64.0.0/10

6. Network profile

Confirmed that the Tailscale adapter is marked as Private in Windows
Confirmed that Bitdefender sees the Tailscale network as Private / Trusted

7. Restarts

Restarted the Tailscale service
Restarted Bitdefender Firewall
Rebooted Windows

None of the above resolved the issue.

Conclusion / question

At this point, the only configuration that works reliably is:

Bitdefender Firewall disabled
All other Bitdefender protection layers enabled
Windows Defender Firewall handling network filtering instead

My questions are:

Is Bitdefender Firewall known to block TCP traffic on VPN-style virtual adapters (such as Tailscale) at a driver level, regardless of rules?
Is there a supported way to fully trust or exclude a virtual adapter from Firewall inspection?
Are there specific rule semantics (direction, “System” vs application, adapter binding) that I may have misunderstood?

I am happy to provide logs or additional diagnostics if useful. My goal is not to bypass security, but to make Bitdefender Firewall work correctly with modern mesh VPNs like Tailscale. Not least because I now have a subscription of Bitdefender until 2027 and am keen to stick it out with Bitdefender.

Thank you very much for your help.

Find more posts tagged with

Comments

JanM47

I have same issue. But. On one system, connection works without issue - Windows 11 Home. On another with Windows 11 Pro I have to disable firewall if I want to access shared folder via Tailscale. I did not find what is wrong.

Alexandru_BD

Hi,

I think there are some general considerations here. VPN-style virtual adapters like Tailscale’s interface can confuse firewalls because the firewall must bind rules to an interface that only exists when the Tailscale service is active. This makes pre-binding rules harder to enforce correctly. Looking at GitHub chats and various discussions on this topic, it seems that some network products or firewall vendors treat virtual adapters differently e.g., as untrusted or zero-trust, unless they explicitly support that adapter type. This is a known challenge with VPN/mesh-network adapters across many firewall products, not just Bitdefender..

Certain VPN clients, including Tailscale, sometimes bypass or add “allow all” rules at the OS netfilter level, meaning a firewall that doesn’t account for it can misinterpret traffic origin/direction. This could explain why TCP might be blocked even with rules.. my hypothesis is that the firewall is evaluating traffic before or independent of Tailscale’s virtual adapter context. Rules targeting tailscale.exe or ports may not match the actual packets, since the packets are associated with a virtual adapter and possibly the “System” user/kernel. ICMP and UDP appear allowed because Bitdefender may permit lightweight/connectionless traffic through, but stateful TCP flows get blocked when the firewall engine can’t attribute them properly to an allowed rule. Disabling the firewall removes that ambiguity, letting Windows/Linux networking handle the traffic. Again, this is only an explanation consistent with general firewall behavior.

Considering your setup, I think you can let Windows firewall handle the filtering works with Tailscale while keeping other Bitdefender modules enabled, if that works for you. I can't think of something else, as there's no confirmed recipe for how to do this for Tailscale, at least I was unable to find one…

Regards