{"record":{"id":"bc1549b1fa2239f1","repo":"tailscale/tailscale","slug":"ip-forwarding-is-set-to-off-subnet-routes-won-t-w","errorCode":null,"errorMessage":"IP forwarding is set to off. Subnet routes won't work. Try 'routeadm -u -e %s-forwarding'","messagePattern":"IP forwarding is set to off\\. Subnet routes won't work\\. Try 'routeadm -u -e (.+?)-forwarding'","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"net/netutil/ip_forward.go","lineNumber":254,"sourceCode":"}\n\nfunc ipForwardingEnabledSunOS(p protocol, iface string) (bool, error) {\n\tvar proto string\n\tif p == ipv4 {\n\t\tproto = \"ipv4\"\n\t} else if p == ipv6 {\n\t\tproto = \"ipv6\"\n\t} else {\n\t\treturn false, fmt.Errorf(\"unknown protocol\")\n\t}\n\n\tipadmCmd := \"\\\"ipadm show-prop \" + proto + \" -p forwarding -o CURRENT -c\\\"\"\n\tbs, err := exec.Command(\"ipadm\", \"show-prop\", proto, \"-p\", \"forwarding\", \"-o\", \"CURRENT\", \"-c\").Output()\n\tif err != nil {\n\t\treturn false, fmt.Errorf(\"couldn't check %s (%v).\\nSubnet routes won't work without IP forwarding.\", ipadmCmd, err)\n\t}\n\tif string(bs) != \"on\\n\" {\n\t\treturn false, fmt.Errorf(\"IP forwarding is set to off. Subnet routes won't work. Try 'routeadm -u -e %s-forwarding'\", proto)\n\t}\n\treturn true, nil\n}\n","sourceCodeStart":236,"sourceCodeEnd":258,"githubUrl":"https://github.com/tailscale/tailscale/blob/6e0912f97994f927632b34ae9e63b53d6516a6ac/net/netutil/ip_forward.go#L236-L258","documentation":"On Solaris/illumos, ipadm ran successfully but reported forwarding as off for the protocol (output was not exactly 'on\\n'). The error prescribes the exact remedy: routeadm -u -e <proto>-forwarding. Returned by ipForwardingEnabledSunOS and surfaced through CheckIPForwarding's 'Couldn't check system's IP forwarding configuration' wrapper, meaning subnet routes will not forward.","triggerScenarios":"CheckIPForwarding on illumos/solaris where ipv4-forwarding or ipv6-forwarding is disabled: ipadm show-prop ipv4 -p forwarding -o CURRENT -c prints something other than 'on'.","commonSituations":"Fresh SmartOS/illumos zone configured as a Tailscale subnet router without enabling forwarding; default installations ship IP forwarding off.","solutions":["Enable it exactly as suggested: sudo routeadm -u -e ipv4-forwarding (or ipv6-forwarding)","Verify: ipadm show-prop ipv4 -p forwarding -o CURRENT -c should print on","Make it persistent: run routeadm -e ipv4-forwarding without -u to change boot defaults","Restart the daemon / re-run the check to confirm"],"exampleFix":"# before\n$ ipadm show-prop ipv4 -p forwarding -o CURRENT -c\noff\n\n# after\n$ sudo routeadm -u -e ipv4-forwarding\n$ ipadm show-prop ipv4 -p forwarding -o CURRENT -c\non","handlingStrategy":"validation","validationCode":"func sunosForwardingOn(proto string) bool {\n\tout, err := exec.Command(\"ipadm\", \"show-prop\", proto, \"-p\", \"forwarding\", \"-o\", \"CURRENT\", \"-c\").Output()\n\treturn err == nil && string(out) == \"on\\n\"\n}\n\nif !sunosForwardingOn(\"ipv4\") {\n\treturn errors.New(\"enable with: routeadm -u -e ipv4-forwarding\")\n}","typeGuard":null,"tryCatchPattern":"warn, err := netutil.CheckIPForwarding(routes, st)\nif err != nil && strings.Contains(err.Error(), \"IP forwarding is set to off\") {\n\t// follow the embedded routeadm remedy, then re-check\n\tslog.Error(warnOrErr(err))\n}","preventionTips":["Enable ipv4/ipv6-forwarding via routeadm before advertising routes","Persist routeadm settings in the zone's boot defaults","Add a provisioning step that verifies ipadm output is 'on'"],"tags":["go","solaris","illumos","sunos","network","ip-forwarding","routeadm"],"backgroundTag":"ip-forwarding-disabled","analyzedSha":"6e0912f97994f927632b34ae9e63b53d6516a6ac","analyzedAt":"2026-08-18T08:17:25.280Z","contentChangedAt":"2026-08-18T08:17:25.280Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}