IP forwarding is set to off. Subnet routes won't work. Try '

Error message

IP forwarding is set to off. Subnet routes won't work. Try 'routeadm -u -e %s-forwarding'

What it means

On Solaris/illumos, ipadm ran successfully but reported forwarding as off for the protocol (output was not exactly 'on\n'). The error prescribes the exact remedy: routeadm -u -e <proto>-forwarding. Returned by ipForwardingEnabledSunOS and surfaced through CheckIPForwarding's 'Couldn't check system's IP forwarding configuration' wrapper, meaning subnet routes will not forward.

Source

Thrown at net/netutil/ip_forward.go:254

}

func ipForwardingEnabledSunOS(p protocol, iface string) (bool, error) {
	var proto string
	if p == ipv4 {
		proto = "ipv4"
	} else if p == ipv6 {
		proto = "ipv6"
	} else {
		return false, fmt.Errorf("unknown protocol")
	}

	ipadmCmd := "\"ipadm show-prop " + proto + " -p forwarding -o CURRENT -c\""
	bs, err := exec.Command("ipadm", "show-prop", proto, "-p", "forwarding", "-o", "CURRENT", "-c").Output()
	if err != nil {
		return false, fmt.Errorf("couldn't check %s (%v).\nSubnet routes won't work without IP forwarding.", ipadmCmd, err)
	}
	if string(bs) != "on\n" {
		return false, fmt.Errorf("IP forwarding is set to off. Subnet routes won't work. Try 'routeadm -u -e %s-forwarding'", proto)
	}
	return true, nil
}

View on GitHub (pinned to 6e0912f979)

Solutions

Enable it exactly as suggested: sudo routeadm -u -e ipv4-forwarding (or ipv6-forwarding)
Verify: ipadm show-prop ipv4 -p forwarding -o CURRENT -c should print on
Make it persistent: run routeadm -e ipv4-forwarding without -u to change boot defaults
Restart the daemon / re-run the check to confirm

Example fix

# before
$ ipadm show-prop ipv4 -p forwarding -o CURRENT -c
off

# after
$ sudo routeadm -u -e ipv4-forwarding
$ ipadm show-prop ipv4 -p forwarding -o CURRENT -c
on

Defensive patterns

Strategy: validation

Validate before calling

func sunosForwardingOn(proto string) bool {
	out, err := exec.Command("ipadm", "show-prop", proto, "-p", "forwarding", "-o", "CURRENT", "-c").Output()
	return err == nil && string(out) == "on\n"
}

if !sunosForwardingOn("ipv4") {
	return errors.New("enable with: routeadm -u -e ipv4-forwarding")
}

Try / catch

warn, err := netutil.CheckIPForwarding(routes, st)
if err != nil && strings.Contains(err.Error(), "IP forwarding is set to off") {
	// follow the embedded routeadm remedy, then re-check
	slog.Error(warnOrErr(err))
}

Prevention

Enable ipv4/ipv6-forwarding via routeadm before advertising routes
Persist routeadm settings in the zone's boot defaults
Add a provisioning step that verifies ipadm output is 'on'

When it happens

Trigger: CheckIPForwarding on illumos/solaris where ipv4-forwarding or ipv6-forwarding is disabled: ipadm show-prop ipv4 -p forwarding -o CURRENT -c prints something other than 'on'.

Common situations: Fresh SmartOS/illumos zone configured as a Tailscale subnet router without enabling forwarding; default installations ship IP forwarding off.

Related errors

AI-assisted analysis of tailscale/tailscale@6e0912f979 (2026-08-18). Data as JSON: /api/errors/bc1549b1fa2239f1. Report an issue: GitHub.