{"record":{"id":"b1024b13988fe9f2","repo":"tailscale/tailscale","slug":"deleting-loopback-allow-rule-for-q-w","errorCode":null,"errorMessage":"deleting loopback allow rule for %q: %w","messagePattern":"deleting loopback allow rule for %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"util/linuxfw/iptables_runner.go","lineNumber":113,"sourceCode":"}\n\n// DelLoopbackRule removes the iptables rule permitting loopback\n// traffic to a Tailscale IP. A missing rule is not an error: an address\n// left on the interface by a previous tailscaled instance never went\n// through AddLoopbackRule in this one, so removing it must not be\n// blocked by the absence of its loopback rule.\nfunc (i *iptablesRunner) DelLoopbackRule(addr netip.Addr) error {\n\tipt := i.getIPTByAddr(addr)\n\targs := []string{\"-i\", \"lo\", \"-s\", addr.String(), \"-j\", \"ACCEPT\"}\n\texists, err := ipt.Exists(\"filter\", \"ts-input\", args...)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"checking loopback allow rule for %q: %w\", addr, err)\n\t}\n\tif !exists {\n\t\treturn nil\n\t}\n\tif err := ipt.Delete(\"filter\", \"ts-input\", args...); err != nil {\n\t\treturn fmt.Errorf(\"deleting loopback allow rule for %q: %w\", addr, err)\n\t}\n\n\treturn nil\n}\n\n// getTables gets the available iptablesInterface in iptables runner.\nfunc (i *iptablesRunner) getTables() []iptablesInterface {\n\tif i.HasIPV6Filter() {\n\t\treturn []iptablesInterface{i.ipt4, i.ipt6}\n\t}\n\treturn []iptablesInterface{i.ipt4}\n}\n\n// getNATTables gets the available iptablesInterface in iptables runner.\n// If the system does not support IPv6 NAT, only the IPv4 iptablesInterface\n// is returned.\nfunc (i *iptablesRunner) getNATTables() []iptablesInterface {\n\tif i.HasIPV6NAT() {","sourceCodeStart":95,"sourceCodeEnd":131,"githubUrl":"https://github.com/tailscale/tailscale/blob/6e0912f97994f927632b34ae9e63b53d6516a6ac/util/linuxfw/iptables_runner.go#L95-L131","documentation":"After Exists confirmed the rule is present, iptables Delete of the loopback allow rule in filter/ts-input failed. The removal command itself errored — typically a lost race with concurrent chain flush, or permission/table problem arising mid-operation.","triggerScenarios":"Thrown at util/linuxfw/iptables_runner.go:113 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Re-check existence and retry delete to absorb races with concurrent netfilter mutation","Confirm sustained privileges during the whole operation","If the chain was flushed externally, treat the goal as achieved (rule gone) and verify with a final Exists check"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"6e0912f97994f927632b34ae9e63b53d6516a6ac","analyzedAt":"2026-08-18T08:17:25.280Z","contentChangedAt":"2026-08-18T08:17:25.280Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}