tailscale/tailscale · error

error checking if chain %s exists: %w

Error message

error checking if chain %s exists: %w

What it means

DeletePortMapRuleForSvc failed to fetch the per-service chain from the nat table; getChainFromTable returned an error other than the expected errorChainNotFound sentinel. This is a genuine lookup failure (netlink error), not a missing chain — a missing chain is handled by returning nil.

Source

Thrown at util/linuxfw/nftables_for_svcs.go:77

// It finds the matching rule using metadata attached to the rule.
// The caller is expected to call DeleteSvc if the whole service (the chain)
// needs to be deleted, so we don't deal with the case where this is the only
// rule in the chain here.
func (n *nftablesRunner) DeletePortMapRuleForSvc(svc, tun string, targetIP netip.Addr, pm PortMap) error {
	table, err := n.getNFTByAddr(targetIP)
	if err != nil {
		return fmt.Errorf("error setting up nftables for IP family of %s: %w", targetIP, err)
	}
	t, err := getTableIfExists(n.conn, table.Proto, "nat")
	if err != nil {
		return fmt.Errorf("error checking if nat table exists: %w", err)
	}
	if t == nil {
		return nil
	}
	ch, err := getChainFromTable(n.conn, t, svc)
	if err != nil && !errors.Is(err, errorChainNotFound{t.Name, svc}) {
		return fmt.Errorf("error checking if chain %s exists: %w", svc, err)
	}
	if errors.Is(err, errorChainNotFound{t.Name, svc}) {
		return nil // service chain does not exist, so neither does the portmapping rule
	}
	meta := svcPortMapRuleMeta(svc, targetIP, pm)
	rule, err := n.findRuleByMetadata(t, ch, meta)
	if err != nil {
		return fmt.Errorf("error checking if rule exists: %w", err)
	}
	if rule == nil {
		return nil
	}
	if err := n.conn.DelRule(rule); err != nil {
		return fmt.Errorf("error deleting rule: %w", err)
	}
	return n.conn.Flush()
}

View on GitHub (pinned to 6e0912f979)

Solutions

1. Retry the chain lookup after a short delay.
2. Inspect the wrapped error for the underlying netlink cause.
3. Verify table/chain state with 'nft list table ip nat'.

When it happens

Trigger: Thrown at util/linuxfw/nftables_for_svcs.go:77 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of tailscale/tailscale@6e0912f979 (2026-08-18). Data as JSON: /api/errors/519390e21cca8cc2. Report an issue: GitHub.