tailscale/tailscale · error

deleting loopback allow rule for %q: %w

Error message

deleting loopback allow rule for %q: %w

What it means

After Exists confirmed the rule is present, iptables Delete of the loopback allow rule in filter/ts-input failed. The removal command itself errored — typically a lost race with concurrent chain flush, or permission/table problem arising mid-operation.

Source

Thrown at util/linuxfw/iptables_runner.go:113

}

// DelLoopbackRule removes the iptables rule permitting loopback
// traffic to a Tailscale IP. A missing rule is not an error: an address
// left on the interface by a previous tailscaled instance never went
// through AddLoopbackRule in this one, so removing it must not be
// blocked by the absence of its loopback rule.
func (i *iptablesRunner) DelLoopbackRule(addr netip.Addr) error {
	ipt := i.getIPTByAddr(addr)
	args := []string{"-i", "lo", "-s", addr.String(), "-j", "ACCEPT"}
	exists, err := ipt.Exists("filter", "ts-input", args...)
	if err != nil {
		return fmt.Errorf("checking loopback allow rule for %q: %w", addr, err)
	}
	if !exists {
		return nil
	}
	if err := ipt.Delete("filter", "ts-input", args...); err != nil {
		return fmt.Errorf("deleting loopback allow rule for %q: %w", addr, err)
	}

	return nil
}

// getTables gets the available iptablesInterface in iptables runner.
func (i *iptablesRunner) getTables() []iptablesInterface {
	if i.HasIPV6Filter() {
		return []iptablesInterface{i.ipt4, i.ipt6}
	}
	return []iptablesInterface{i.ipt4}
}

// getNATTables gets the available iptablesInterface in iptables runner.
// If the system does not support IPv6 NAT, only the IPv4 iptablesInterface
// is returned.
func (i *iptablesRunner) getNATTables() []iptablesInterface {
	if i.HasIPV6NAT() {

View on GitHub (pinned to 6e0912f979)

Solutions

1. Re-check existence and retry delete to absorb races with concurrent netfilter mutation
2. Confirm sustained privileges during the whole operation
3. If the chain was flushed externally, treat the goal as achieved (rule gone) and verify with a final Exists check

When it happens

Trigger: Thrown at util/linuxfw/iptables_runner.go:113 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of tailscale/tailscale@6e0912f979 (2026-08-18). Data as JSON: /api/errors/b1024b13988fe9f2. Report an issue: GitHub.