tailscale/tailscale · error

Failed to find hook rule: %w

Error message

Failed to find hook rule: %w

What it means

delHookRule failed while searching for the existing jump rule with findRule; the lookup of the hook rule errored (netlink failure), so it cannot be determined whether the rule exists and deletion is aborted.

Source

Thrown at util/linuxfw/nftables_runner.go:1136

		postroutingChain, err := getChainFromTable(conn, table.Nat, "POSTROUTING")
		if err != nil {
			return fmt.Errorf("get INPUT chain: %w", err)
		}
		err = addHookRule(conn, table.Nat, postroutingChain, chainNamePostrouting)
		if err != nil {
			return fmt.Errorf("Addhook: %w", err)
		}
	}
	return nil
}

// delHookRule deletes a rule that jumps from a hooked chain to a regular chain.
func delHookRule(conn *nftables.Conn, table *nftables.Table, fromChain *nftables.Chain, toChainName string) error {
	rule := createHookRule(table, fromChain, toChainName)
	existingRule, err := findRule(conn, rule)
	if err != nil {
		return fmt.Errorf("Failed to find hook rule: %w", err)
	}

	if existingRule == nil {
		return nil
	}

	_ = conn.DelRule(existingRule)

	if err := conn.Flush(); err != nil {
		return fmt.Errorf("flush del hook rule: %w", err)
	}
	return nil
}

// DelHooks is deleting the rules added to conventional chains to jump to tailscale chains.
func (n *nftablesRunner) DelHooks(logf logger.Logf) error {
	conn := n.conn

View on GitHub (pinned to 6e0912f979)

Solutions

1. Retry DelHooks; rule lookup failures are often transient.
2. Verify the hooked chain is readable via 'nft list ruleset'.
3. Check netlink socket health and permissions.

When it happens

Trigger: Thrown at util/linuxfw/nftables_runner.go:1136 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of tailscale/tailscale@6e0912f979 (2026-08-18). Data as JSON: /api/errors/2ddfcfe5e90d198b. Report an issue: GitHub.