{"record":{"id":"d614b582504ddba7","repo":"tailscale/tailscale","slug":"iptables-command-run-fail-w","errorCode":null,"errorMessage":"iptables command run fail: %w","messagePattern":"iptables command run fail: %w","errorType":"exception","errorClass":"FWModeNotSupportedError","httpStatus":null,"severity":"error","filePath":"util/linuxfw/iptables.go","lineNumber":67,"sourceCode":"\toutput, err := cmd.Output()\n\tip6cmd := exec.Command(\"ip6tables\", \"-S\")\n\tip6output, ip6err := ip6cmd.Output()\n\tvar allLines []string\n\toutputStr := string(output)\n\tlines := strings.Split(outputStr, \"\\n\")\n\tip6outputStr := string(ip6output)\n\tip6lines := strings.Split(ip6outputStr, \"\\n\")\n\tswitch {\n\tcase err == nil && ip6err == nil:\n\t\tallLines = append(lines, ip6lines...)\n\tcase err == nil && ip6err != nil:\n\t\tallLines = lines\n\tcase err != nil && ip6err == nil:\n\t\tallLines = ip6lines\n\tdefault:\n\t\treturn 0, FWModeNotSupportedError{\n\t\t\tMode: FirewallModeIPTables,\n\t\t\tErr:  fmt.Errorf(\"iptables command run fail: %w\", errors.Join(err, ip6err)),\n\t\t}\n\t}\n\n\t// count the number of non-default rules\n\tcount := 0\n\tfor _, line := range allLines {\n\t\ttrimmedLine := strings.TrimLeftFunc(line, unicode.IsSpace)\n\t\tif line != \"\" && strings.HasPrefix(trimmedLine, \"-A\") {\n\t\t\t// if the line is not empty and starts with \"-A\", it is a rule appended not default\n\t\t\tcount++\n\t\t}\n\t}\n\n\t// return the count of non-default rules\n\treturn count, nil\n}\n\n// newIPTablesRunner constructs a NetfilterRunner that programs iptables rules.","sourceCodeStart":49,"sourceCodeEnd":85,"githubUrl":"https://github.com/tailscale/tailscale/blob/6e0912f97994f927632b34ae9e63b53d6516a6ac/util/linuxfw/iptables.go#L49-L85","documentation":"detectIptables found that both `iptables -S` and `ip6tables -S` failed to run (neither produced output), so it cannot inspect rules and reports FWModeNotSupportedError wrapping this message. Root causes: binaries missing, not executable, or lacking CAP_NET_ADMIN; it is a firewall-detection failure, not a rule error.","triggerScenarios":"Thrown at util/linuxfw/iptables.go:67 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Install iptables/ip6tables packages or ensure they are on PATH","Run with sufficient privileges (root/CAP_NET_ADMIN) so the commands execute","Have the caller fall back to another firewall mode detector (nftables) when this error surfaces"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"6e0912f97994f927632b34ae9e63b53d6516a6ac","analyzedAt":"2026-08-18T08:17:25.280Z","contentChangedAt":"2026-08-18T08:17:25.280Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}