Tailscale status warning - NFT / IPTables related

Installing and Using OpenWrt
1

I'm setting up Tailscale on my router for a site-to-site connection, and I'm getting an error in the health check section of tailscale status:

# Health check:
#     - router: deleting [-m mark --mark 0x40000/0xff0000 -j MASQUERADE] in nat/ts-postrouting: running [/usr/sbin/iptables -t nat -D ts-postrouting -m mark --mark 0x40000/0xff0000 -j MASQUERADE --wait]: exit status 1: Warning: Extension MASQUERADE revision 0 not supported, missing kernel module?
iptables: Bad rule (does a matching rule exist in that chain?).

Does anyone know what effect this might have? And also, more importantly, how to fix it?

2

Please help with your device description

iptables -V
ip6tables -V
nft -V
ubus call system board
opkg list-installed tailscale
3

Yes, it's broken.
OpenWrt has not used iptables by default for years. Any packages using it should be considered unmaintained, as otherwise they would have been migrated to nftables long ago.

Sure, if you really know what you are doing, you can hack about and build an iptables ruleset, maybe replace fw4 with fw3 etc. etc., but, to be realistic, if you have to ask here, you will not have the necessary in depth knowledge to get it going.

Use an up to date package to do the job.

1 Like