tailscale/tailscale · error

create match subnet route mark rule: %w

Error message

create match subnet route mark rule: %w

What it means

addMatchSubnetRouteMarkRule failed to construct the mark-matching rule via createMatchSubnetRouteMarkRule — an internal expression-building failure (e.g. unsupported family or immediate/payload expression error), not a kernel operation failure.

Source

Thrown at util/linuxfw/nftables_runner.go:1866

		},
		&expr.Counter{},
		endAction,
	}

	rule := &nftables.Rule{
		Table: table,
		Chain: chain,
		Exprs: exprs,
	}
	return rule, nil
}

// addMatchSubnetRouteMarkRule adds a rule that matches packets with
// the subnet route mark and takes the specified action.
func addMatchSubnetRouteMarkRule(conn *nftables.Conn, table *nftables.Table, chain *nftables.Chain, action MatchDecision) error {
	rule, err := createMatchSubnetRouteMarkRule(table, chain, action)
	if err != nil {
		return fmt.Errorf("create match subnet route mark rule: %w", err)
	}
	_ = conn.AddRule(rule)

	if err := conn.Flush(); err != nil {
		return fmt.Errorf("flush add rule: %w", err)
	}

	return nil
}

// AddSNATRule adds a netfilter rule to SNAT traffic destined for
// local subnets.
func (n *nftablesRunner) AddSNATRule() error {
	conn := n.conn

	for _, table := range n.getTables() {
		chain, err := getChainFromTable(conn, table.Nat, chainNamePostrouting)
		if err != nil {

View on GitHub (pinned to 6e0912f979)

Solutions

1. Inspect the wrapped error for which expression failed to build.
2. Verify the table family is supported by the rule builder.
3. Retry after fixing the family/chain parameters.

When it happens

Trigger: Thrown at util/linuxfw/nftables_runner.go:1866 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of tailscale/tailscale@6e0912f979 (2026-08-18). Data as JSON: /api/errors/7ac9c12db2a4a361. Report an issue: GitHub.