tailscale/tailscale · error

path not found: %w

Error message

path not found: %w

What it means

checkIP6TablesExists wraps exec.LookPath's failure to find an ip6tables binary anywhere on PATH. Some distros package ip6tables separately from iptables; without it, IPv6 firewall management is impossible and the runner is constructed without v6 support.

Source

Thrown at util/linuxfw/iptables_runner.go:51

	List(table, chain string) ([]string, error)
	ClearChain(table, chain string) error
	NewChain(table, chain string) error
	DeleteChain(table, chain string) error
}

type iptablesRunner struct {
	ipt4 iptablesInterface
	ipt6 iptablesInterface

	v6Available       bool
	v6NATAvailable    bool
	v6FilterAvailable bool
}

func checkIP6TablesExists() error {
	// Some distros ship ip6tables separately from iptables.
	if _, err := exec.LookPath("ip6tables"); err != nil {
		return fmt.Errorf("path not found: %w", err)
	}
	return nil
}

// HasIPV6 reports true if the system supports IPv6.
func (i *iptablesRunner) HasIPV6() bool {
	return i.v6Available
}

// HasIPV6Filter reports true if the system supports ip6tables filter table.
func (i *iptablesRunner) HasIPV6Filter() bool {
	return i.v6FilterAvailable
}

// HasIPV6NAT reports true if the system supports IPv6 NAT.
func (i *iptablesRunner) HasIPV6NAT() bool {
	return i.v6NATAvailable
}

View on GitHub (pinned to 6e0912f979)

Solutions

1. Install the ip6tables package (e.g. iptables-ipv6 / nftables-compatible package) on the host
2. If IPv6 is intentionally unsupported, let newIPTablesRunner proceed with v6 disabled — callers treat this as advisory
3. Verify PATH inside containers includes /usr/sbin where iptables tools often live

When it happens

Trigger: Thrown at util/linuxfw/iptables_runner.go:51 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of tailscale/tailscale@6e0912f979 (2026-08-18). Data as JSON: /api/errors/c482cd8611ca4408. Report an issue: GitHub.