tailscale/tailscale · error

add cgnat rules: %w

Error message

add cgnat rules: %w

What it means

During netfilter mode reprocessing, setNetfilterModeLocked failed to re-add the previously-configured CGNAT external rules (AddExternalCGNATRules). On failure the code resets cgnatMode so a later pass reinstalls them.

Source

Thrown at wgengine/router/osrouter/router_linux.go:897

	}

	for cidr := range r.addrs {
		if err := r.addLoopbackRule(cidr.Addr()); err != nil {
			return fmt.Errorf("error adding loopback rule: %w", err)
		}
	}

	// Re-add the CGNAT rules if we had any set.
	// This does not call [linuxRouter.setCGNATDropModeLocked] because that
	// function assumes that [linuxRouter.cgnatMode] accurately represents the
	// current state in the firewall. This would not be true when we hit this
	// code path, and is what we're fixing up here.
	if r.cgnatMode != "" {
		if err := r.nfr.AddExternalCGNATRules(r.cgnatMode, r.tunname); err != nil {
			// We currently have no rules set, so change the state to reflect that
			// so we might try again on a future Router update.
			r.cgnatMode = ""
			return fmt.Errorf("add cgnat rules: %w", err)
		}
	}

	return nil
}

// getV6FilteringAvailable returns true if the router is able to setup the
// required tailscale filter rules for IPv6.
func (r *linuxRouter) getV6FilteringAvailable() bool {
	if r.nfr == nil {
		return false
	}
	return r.nfr.HasIPV6() && r.nfr.HasIPV6Filter()
}

// getV6Available reports whether the router can manage IPv6. r.nfr can be nil if
// setupNetfilterLocked failed earlier in Set (which continues on error), so
// treat a nil runner as no IPv6 rather than dereferencing it.

View on GitHub (pinned to 6e0912f979)

Solutions

1. Inspect the wrapped netfilter error
2. Retry the netfilter mode switch / router Set so CGNAT rules are reinstalled
3. Check for external interference with the Tailscale chains

When it happens

Trigger: Thrown at wgengine/router/osrouter/router_linux.go:897 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of tailscale/tailscale@6e0912f979 (2026-08-18). Data as JSON: /api/errors/f7e12e9c2f2a1f26. Report an issue: GitHub.