tailscale/tailscale · error

checking for %v in %s/%s: %w

Error message

checking for %v in %s/%s: %w

What it means

Inside AddHooks' divert closure, the Exists probe for the '-j ts-<chain>' jump in the parent table/chain failed — the iptables query errored (permissions, binary, missing table). The %v/%s/%s name the jump target, table, and chain. Idempotency depends on this check: a jump already present is a no-op, so failure here blocks both detection and insertion.

Source

Thrown at util/linuxfw/iptables_runner.go:149

	if i.HasIPV6NAT() {
		return i.getTables()
	}
	return []iptablesInterface{i.ipt4}
}

// AddHooks inserts calls to tailscale's netfilter chains in
// the relevant main netfilter chains. The tailscale chains must
// already exist. If they do not, an error is returned.
func (i *iptablesRunner) AddHooks() error {
	// divert inserts a jump to the tailscale chain in the given table/chain.
	// If the jump already exists, it is a no-op.
	divert := func(ipt iptablesInterface, table, chain string) error {
		tsChain := tsChain(chain)

		args := []string{"-j", tsChain}
		exists, err := ipt.Exists(table, chain, args...)
		if err != nil {
			return fmt.Errorf("checking for %v in %s/%s: %w", args, table, chain, err)
		}
		if exists {
			return nil
		}
		if err := ipt.Insert(table, chain, 1, args...); err != nil {
			return fmt.Errorf("adding %v in %s/%s: %w", args, table, chain, err)
		}
		return nil
	}

	for _, ipt := range i.getTables() {
		if err := divert(ipt, "filter", "INPUT"); err != nil {
			return err
		}
		if err := divert(ipt, "filter", "FORWARD"); err != nil {
			return err
		}
	}

View on GitHub (pinned to 6e0912f979)

Solutions

1. Ensure privileges and iptables availability before hook installation
2. Run AddChains first so the ts- chains the jumps target exist
3. Retry AddHooks after fixing the environment; it is idempotent when probes succeed

When it happens

Trigger: Thrown at util/linuxfw/iptables_runner.go:149 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of tailscale/tailscale@6e0912f979 (2026-08-18). Data as JSON: /api/errors/e5b09fe1d1ebe8f8. Report an issue: GitHub.