{"record":{"id":"ce7d5b5044ac8485","repo":"tailscale/tailscale","slug":"flushing-s-s-w","errorCode":null,"errorMessage":"flushing %s/%s: %w","messagePattern":"flushing (.+?)/(.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"util/linuxfw/iptables_runner.go","lineNumber":409,"sourceCode":"\t\tif err := delChain(ipt, \"nat\", \"ts-postrouting\"); err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\n\treturn nil\n}\n\n// DelBase empties but does not remove custom Tailscale chains from\n// netfilter via iptables.\nfunc (i *iptablesRunner) DelBase() error {\n\tdel := func(ipt iptablesInterface, table, chain string) error {\n\t\tif err := ipt.ClearChain(table, chain); err != nil {\n\t\t\tif isNotExistError(err) {\n\t\t\t\t// nonexistent chain. That's fine, since it's\n\t\t\t\t// the desired state anyway.\n\t\t\t\treturn nil\n\t\t\t}\n\t\t\treturn fmt.Errorf(\"flushing %s/%s: %w\", table, chain, err)\n\t\t}\n\t\treturn nil\n\t}\n\n\tfor _, ipt := range i.getTables() {\n\t\tif err := del(ipt, \"filter\", \"ts-input\"); err != nil {\n\t\t\treturn err\n\t\t}\n\t\tif err := del(ipt, \"filter\", \"ts-forward\"); err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\tfor _, ipt := range i.getNATTables() {\n\t\tif err := del(ipt, \"nat\", \"ts-postrouting\"); err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n","sourceCodeStart":391,"sourceCodeEnd":427,"githubUrl":"https://github.com/tailscale/tailscale/blob/6e0912f97994f927632b34ae9e63b53d6516a6ac/util/linuxfw/iptables_runner.go#L391-L427","documentation":"DelBase's del helper: ClearChain (flush) on a table/chain errored with something other than not-exist (which returns nil as desired state). The flush of a Tailscale chain failed — typically permissions or transient ip(6)tables failure during teardown; %s/%s name the table and chain.","triggerScenarios":"Thrown at util/linuxfw/iptables_runner.go:409 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Retry DelBase — teardown runs while interfaces/rules may still be settling","Verify privileges persist through shutdown (not a torn-down namespace)","Tolerate leftover empty chains if a later cleanup pass runs: not-exist is already treated as success"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"6e0912f97994f927632b34ae9e63b53d6516a6ac","analyzedAt":"2026-08-18T08:17:25.280Z","contentChangedAt":"2026-08-18T08:17:25.280Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}