{"record":{"id":"87a3fde26d0ceb6c","repo":"tailscale/tailscale","slug":"adding-loopback-allow-rule-for-q-w","errorCode":null,"errorMessage":"adding loopback allow rule for %q: %w","messagePattern":"adding loopback allow rule for %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"util/linuxfw/iptables_runner.go","lineNumber":85,"sourceCode":"func (i *iptablesRunner) HasIPV6NAT() bool {\n\treturn i.v6NATAvailable\n}\n\n// getIPTByAddr returns the iptablesInterface with correct IP family\n// that we will be using for the given address.\nfunc (i *iptablesRunner) getIPTByAddr(addr netip.Addr) iptablesInterface {\n\tnf := i.ipt4\n\tif addr.Is6() {\n\t\tnf = i.ipt6\n\t}\n\treturn nf\n}\n\n// AddLoopbackRule adds an iptables rule to permit loopback traffic to\n// a local Tailscale IP.\nfunc (i *iptablesRunner) AddLoopbackRule(addr netip.Addr) error {\n\tif err := i.getIPTByAddr(addr).Insert(\"filter\", \"ts-input\", 1, \"-i\", \"lo\", \"-s\", addr.String(), \"-j\", \"ACCEPT\"); err != nil {\n\t\treturn fmt.Errorf(\"adding loopback allow rule for %q: %w\", addr, err)\n\t}\n\n\treturn nil\n}\n\n// tsChain returns the name of the tailscale sub-chain corresponding\n// to the given \"parent\" chain (e.g. INPUT, FORWARD, ...).\nfunc tsChain(chain string) string {\n\treturn \"ts-\" + strings.ToLower(chain)\n}\n\n// DelLoopbackRule removes the iptables rule permitting loopback\n// traffic to a Tailscale IP. A missing rule is not an error: an address\n// left on the interface by a previous tailscaled instance never went\n// through AddLoopbackRule in this one, so removing it must not be\n// blocked by the absence of its loopback rule.\nfunc (i *iptablesRunner) DelLoopbackRule(addr netip.Addr) error {\n\tipt := i.getIPTByAddr(addr)","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/tailscale/tailscale/blob/6e0912f97994f927632b34ae9e63b53d6516a6ac/util/linuxfw/iptables_runner.go#L67-L103","documentation":"AddLoopbackRule's iptables Insert into filter/ts-input (allow '-i lo -s <addr>') failed. The Exists/Insert invocation errored at the iptables level — missing ts-input chain (AddBase not run yet), no CAP_NET_ADMIN, or binary/table problems — not a duplicate-rule condition (Insert doesn't check).","triggerScenarios":"Thrown at util/linuxfw/iptables_runner.go:85 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Ensure AddBase/AddChains ran first so the ts-input chain exists","Run with root privileges and iptables installed","Retry after the environment issues are fixed; the rule is idempotent in intent, so re-adding is safe"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"6e0912f97994f927632b34ae9e63b53d6516a6ac","analyzedAt":"2026-08-18T08:17:25.280Z","contentChangedAt":"2026-08-18T08:17:25.280Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}