invalid proxy firewall mode %s, valid modes are iptables, nf

Error message

invalid proxy firewall mode %s, valid modes are iptables, nftables or unset

What it means

Error "invalid proxy firewall mode %s, valid modes are iptables, nftables or unset" thrown in tailscale/tailscale.

Source

Thrown at cmd/k8s-operator/sts.go:194

type tsnetServer interface {
	CertDomains() []string
}

type tailscaleSTSReconciler struct {
	client.Client
	tsnetServer            tsnetServer
	clients                ClientProvider
	defaultTags            []string
	operatorNamespace      string
	proxyImage             string
	proxyPriorityClassName string
	tsFirewallMode         string
	loginServer            string
}

func (r *tailscaleSTSReconciler) validate() error {
	if r.tsFirewallMode != "" && !isValidFirewallMode(r.tsFirewallMode) {
		return fmt.Errorf("invalid proxy firewall mode %s, valid modes are iptables, nftables or unset", r.tsFirewallMode)
	}
	return nil
}

// IsHTTPSEnabledOnTailnet reports whether HTTPS is enabled on the tailnet.
func IsHTTPSEnabledOnTailnet(tsnetServer tsnetServer) bool {
	return len(tsnetServer.CertDomains()) > 0
}

// Provision ensures that the StatefulSet for the given service is running and
// up to date.
func (r *tailscaleSTSReconciler) Provision(ctx context.Context, logger *zap.SugaredLogger, sts *tailscaleSTSConfig) (*corev1.Service, error) {
	// Do full reconcile.
	// TODO (don't create Service for the Connector)
	hsvc, err := r.reconcileHeadlessService(ctx, logger, sts)
	if err != nil {
		return nil, fmt.Errorf("failed to reconcile headless service: %w", err)
	}

View on GitHub (pinned to cfe32b8be6)

When it happens

Trigger: Thrown at cmd/k8s-operator/sts.go:194 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of tailscale/tailscale@cfe32b8be6 (2026-08-15). Data as JSON: /api/errors/b3edd5e6df72ed71. Report an issue: GitHub.