tailscale/tailscale · error

adding loopback allow rule for %q: %w

Error message

adding loopback allow rule for %q: %w

What it means

AddLoopbackRule's iptables Insert into filter/ts-input (allow '-i lo -s <addr>') failed. The Exists/Insert invocation errored at the iptables level — missing ts-input chain (AddBase not run yet), no CAP_NET_ADMIN, or binary/table problems — not a duplicate-rule condition (Insert doesn't check).

Source

Thrown at util/linuxfw/iptables_runner.go:85

func (i *iptablesRunner) HasIPV6NAT() bool {
	return i.v6NATAvailable
}

// getIPTByAddr returns the iptablesInterface with correct IP family
// that we will be using for the given address.
func (i *iptablesRunner) getIPTByAddr(addr netip.Addr) iptablesInterface {
	nf := i.ipt4
	if addr.Is6() {
		nf = i.ipt6
	}
	return nf
}

// AddLoopbackRule adds an iptables rule to permit loopback traffic to
// a local Tailscale IP.
func (i *iptablesRunner) AddLoopbackRule(addr netip.Addr) error {
	if err := i.getIPTByAddr(addr).Insert("filter", "ts-input", 1, "-i", "lo", "-s", addr.String(), "-j", "ACCEPT"); err != nil {
		return fmt.Errorf("adding loopback allow rule for %q: %w", addr, err)
	}

	return nil
}

// tsChain returns the name of the tailscale sub-chain corresponding
// to the given "parent" chain (e.g. INPUT, FORWARD, ...).
func tsChain(chain string) string {
	return "ts-" + strings.ToLower(chain)
}

// DelLoopbackRule removes the iptables rule permitting loopback
// traffic to a Tailscale IP. A missing rule is not an error: an address
// left on the interface by a previous tailscaled instance never went
// through AddLoopbackRule in this one, so removing it must not be
// blocked by the absence of its loopback rule.
func (i *iptablesRunner) DelLoopbackRule(addr netip.Addr) error {
	ipt := i.getIPTByAddr(addr)

View on GitHub (pinned to 6e0912f979)

Solutions

1. Ensure AddBase/AddChains ran first so the ts-input chain exists
2. Run with root privileges and iptables installed
3. Retry after the environment issues are fixed; the rule is idempotent in intent, so re-adding is safe

When it happens

Trigger: Thrown at util/linuxfw/iptables_runner.go:85 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of tailscale/tailscale@6e0912f979 (2026-08-18). Data as JSON: /api/errors/87a3fde26d0ceb6c. Report an issue: GitHub.