--netfilter-mode values besides "off" not supported on Synol

Error message

--netfilter-mode values besides "off" not supported on Synology; see https://github.com/tailscale/tailscale/issues/1995

What it means

The Synology guard in up.go:546 also requires upArgs.netfilterMode == "off"; any other --netfilter-mode value is rejected since Synology's firewall integration (iptables/nftables management) is unsupported there.

Source

Thrown at cmd/tailscale/cli/up.go:546

			// login.
			return false
		}
		if upArgs.forceReauth && url == origAuthURL {
			return false
		}
		return true
	}

	if distro.Get() == distro.Synology {
		notSupported := "not supported on Synology; see https://github.com/tailscale/tailscale/issues/1995"
		if upArgs.acceptRoutes {
			return errors.New("--accept-routes is " + notSupported)
		}
		if upArgs.exitNodeIP != "" {
			return errors.New("--exit-node is " + notSupported)
		}
		if upArgs.netfilterMode != "off" {
			return errors.New("--netfilter-mode values besides \"off\" " + notSupported)
		}
	}

	prefs, err := prefsFromUpArgs(upArgs, warnf, st, effectiveGOOS())
	if err != nil {
		fatalf("%s", err)
	}

	warnOnAdvertiseRoutes(ctx, prefs)

	curPrefs, err := localClient.GetPrefs(ctx)
	if err != nil {
		return err
	}
	effectivePrefs := curPrefs

	if cmd == "up" {
		// "tailscale up" should not be able to change the

View on GitHub (pinned to cfe32b8be6)

Solutions

Set the mode explicitly to off: `tailscale up --netfilter-mode=off`
Manage firewall rules through Synology's own firewall UI if needed
Remove netfilter flags entirely only if off is already the stored pref on Synology

Example fix

# before
$ tailscale up --netfilter-mode=on
# after (on Synology)
$ tailscale up --netfilter-mode=off

Defensive patterns

Strategy: validation

Validate before calling

if distro.Get() == distro.Synology && upArgs.netfilterMode != "off" {
    return errors.New("only --netfilter-mode=off is supported on Synology")
}

Prevention

Set --netfilter-mode=off explicitly in Synology templates
Manage Synology firewall via its own UI, not tailscale flags

When it happens

Trigger: Running `tailscale up --netfilter-mode=on` (the default on Linux) or = nodivert on a Synology NAS.

Common situations: Default flag sets copied from Linux configs; hardening scripts that set netfilter-mode explicitly; package upgrades where previously tolerated flags now hard-fail.

Related errors

AI-assisted analysis of tailscale/tailscale@cfe32b8be6 (2026-08-15). Data as JSON: /api/errors/ea67c4360ec3423f. Report an issue: GitHub.