{"record":{"id":"ea67c4360ec3423f","repo":"tailscale/tailscale","slug":"netfilter-mode-values-besides-off-not-supporte","errorCode":null,"errorMessage":"--netfilter-mode values besides \"off\" not supported on Synology; see https://github.com/tailscale/tailscale/issues/1995","messagePattern":"--netfilter-mode values besides \"off\" not supported on Synology; see https://github\\.com/tailscale/tailscale/issues/1995","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/tailscale/cli/up.go","lineNumber":546,"sourceCode":"\t\t\t// login.\n\t\t\treturn false\n\t\t}\n\t\tif upArgs.forceReauth && url == origAuthURL {\n\t\t\treturn false\n\t\t}\n\t\treturn true\n\t}\n\n\tif distro.Get() == distro.Synology {\n\t\tnotSupported := \"not supported on Synology; see https://github.com/tailscale/tailscale/issues/1995\"\n\t\tif upArgs.acceptRoutes {\n\t\t\treturn errors.New(\"--accept-routes is \" + notSupported)\n\t\t}\n\t\tif upArgs.exitNodeIP != \"\" {\n\t\t\treturn errors.New(\"--exit-node is \" + notSupported)\n\t\t}\n\t\tif upArgs.netfilterMode != \"off\" {\n\t\t\treturn errors.New(\"--netfilter-mode values besides \\\"off\\\" \" + notSupported)\n\t\t}\n\t}\n\n\tprefs, err := prefsFromUpArgs(upArgs, warnf, st, effectiveGOOS())\n\tif err != nil {\n\t\tfatalf(\"%s\", err)\n\t}\n\n\twarnOnAdvertiseRoutes(ctx, prefs)\n\n\tcurPrefs, err := localClient.GetPrefs(ctx)\n\tif err != nil {\n\t\treturn err\n\t}\n\teffectivePrefs := curPrefs\n\n\tif cmd == \"up\" {\n\t\t// \"tailscale up\" should not be able to change the","sourceCodeStart":528,"sourceCodeEnd":564,"githubUrl":"https://github.com/tailscale/tailscale/blob/cfe32b8be6a33f8e24fbc369cbfbf7c729d9e042/cmd/tailscale/cli/up.go#L528-L564","documentation":"The Synology guard in up.go:546 also requires upArgs.netfilterMode == \"off\"; any other --netfilter-mode value is rejected since Synology's firewall integration (iptables/nftables management) is unsupported there.","triggerScenarios":"Running `tailscale up --netfilter-mode=on` (the default on Linux) or = nodivert on a Synology NAS.","commonSituations":"Default flag sets copied from Linux configs; hardening scripts that set netfilter-mode explicitly; package upgrades where previously tolerated flags now hard-fail.","solutions":["Set the mode explicitly to off: `tailscale up --netfilter-mode=off`","Manage firewall rules through Synology's own firewall UI if needed","Remove netfilter flags entirely only if off is already the stored pref on Synology"],"exampleFix":"# before\n$ tailscale up --netfilter-mode=on\n# after (on Synology)\n$ tailscale up --netfilter-mode=off","handlingStrategy":"validation","validationCode":"if distro.Get() == distro.Synology && upArgs.netfilterMode != \"off\" {\n    return errors.New(\"only --netfilter-mode=off is supported on Synology\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Set --netfilter-mode=off explicitly in Synology templates","Manage Synology firewall via its own UI, not tailscale flags"],"tags":["synology","cli","platform-support","firewall"],"backgroundTag":null,"analyzedSha":"cfe32b8be6a33f8e24fbc369cbfbf7c729d9e042","analyzedAt":"2026-08-15T19:58:31.583Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}