tailscale/tailscale · error

getAppliedConnection: %w

Error message

getAppliedConnection: %w

What it means

nmManager.trySet fetches the device's currently applied connection via org.freedesktop.NetworkManager.Device.GetAppliedConnection to read and later modify its DNS settings. This error wraps that D-Bus call failing: the device has no applied connection (not activated), D-Bus policy rejects the caller, or NM returns an internal error. The fetched settings plus version are prerequisites for the later Reapply call.

Source

Thrown at net/dns/nm.go:128

	err = nm.CallWithContext(
		ctx, "org.freedesktop.NetworkManager.GetDeviceByIpIface", 0,
		m.interfaceName,
	).Store(&devicePath)
	if err != nil {
		return fmt.Errorf("getDeviceByIpIface: %w", err)
	}
	device := conn.Object("org.freedesktop.NetworkManager", devicePath)

	var (
		settings nmConnectionSettings
		version  uint64
	)
	err = device.CallWithContext(
		ctx, "org.freedesktop.NetworkManager.Device.GetAppliedConnection", 0,
		uint32(0),
	).Store(&settings, &version)
	if err != nil {
		return fmt.Errorf("getAppliedConnection: %w", err)
	}

	// Frustratingly, NetworkManager represents IPv4 addresses as uint32s,
	// although IPv6 addresses are represented as byte arrays.
	// Perform the conversion here.
	var (
		dnsv4 []uint32
		dnsv6 [][]byte
	)
	for _, ip := range config.Nameservers {
		b := ip.As16()
		if ip.Is4() {
			dnsv4 = append(dnsv4, binary.NativeEndian.Uint32(b[12:]))
		} else {
			dnsv6 = append(dnsv6, b[:])
		}
	}

View on GitHub (pinned to 6e0912f979)

Solutions

1. Check device state: `nmcli device show tailscale0` — if it is unmanaged/disconnected, bring it to a connected state or let NM manage it.
2. Run tailscaled as root or grant the D-Bus/polkit permissions for NetworkManager device methods.
3. Ensure an address is assigned first — NM only allows setting DNS on 'active' connections (the SetDNS comment calls this out).
4. Retry after NM settles; if it persists, `systemctl restart NetworkManager`.

Retry the full read-modify-write cycle: getAppliedConnection failures from not-yet-activated devices usually clear once NM finishes activation. Distinguish permission errors (polkit) from state errors by inspecting the wrapped D-Bus name — permissions need a fix, state needs a retry.

When it happens

Trigger: device.CallWithContext(GetAppliedConnection, uint32(0)) fails: the tailscale interface exists as a device but is unactivated/unmanaged (state != connected), polkit denies org.freedesktop.NetworkManager.device.* to the caller, or NM hit an internal error serializing the connection.

Common situations: The interface was created raw (ip tuntap) and NM never activated a connection on it; tailscaled running as a user without the needed polkit grants; NM plugins (ifupdown/keyfile) not managing the device so nothing is 'applied'.

Related errors

• connecting to system bus: %w
• getDeviceByIpIface: %w
• reapply: %w
• unexpected NM config type %T
• unexpected type %T for NM version

AI-assisted analysis of tailscale/tailscale@6e0912f979 (2026-08-18). Data as JSON: /api/errors/f59a918003c7cb1a. Report an issue: GitHub.