tailscale/tailscale · error · FWModeNotSupportedError

iptables command run fail: %w

Error message

iptables command run fail: %w

What it means

detectIptables found that both `iptables -S` and `ip6tables -S` failed to run (neither produced output), so it cannot inspect rules and reports FWModeNotSupportedError wrapping this message. Root causes: binaries missing, not executable, or lacking CAP_NET_ADMIN; it is a firewall-detection failure, not a rule error.

Source

Thrown at util/linuxfw/iptables.go:67

	output, err := cmd.Output()
	ip6cmd := exec.Command("ip6tables", "-S")
	ip6output, ip6err := ip6cmd.Output()
	var allLines []string
	outputStr := string(output)
	lines := strings.Split(outputStr, "\n")
	ip6outputStr := string(ip6output)
	ip6lines := strings.Split(ip6outputStr, "\n")
	switch {
	case err == nil && ip6err == nil:
		allLines = append(lines, ip6lines...)
	case err == nil && ip6err != nil:
		allLines = lines
	case err != nil && ip6err == nil:
		allLines = ip6lines
	default:
		return 0, FWModeNotSupportedError{
			Mode: FirewallModeIPTables,
			Err:  fmt.Errorf("iptables command run fail: %w", errors.Join(err, ip6err)),
		}
	}

	// count the number of non-default rules
	count := 0
	for _, line := range allLines {
		trimmedLine := strings.TrimLeftFunc(line, unicode.IsSpace)
		if line != "" && strings.HasPrefix(trimmedLine, "-A") {
			// if the line is not empty and starts with "-A", it is a rule appended not default
			count++
		}
	}

	// return the count of non-default rules
	return count, nil
}

// newIPTablesRunner constructs a NetfilterRunner that programs iptables rules.

View on GitHub (pinned to 6e0912f979)

Solutions

1. Install iptables/ip6tables packages or ensure they are on PATH
2. Run with sufficient privileges (root/CAP_NET_ADMIN) so the commands execute
3. Have the caller fall back to another firewall mode detector (nftables) when this error surfaces

When it happens

Trigger: Thrown at util/linuxfw/iptables.go:67 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of tailscale/tailscale@6e0912f979 (2026-08-18). Data as JSON: /api/errors/d614b582504ddba7. Report an issue: GitHub.