{"slug":"firewall-mode-in-tailscaled","title":"Firewall mode in tailscaled","tags":["tailscale"],"agent_summary":"Last validated: Dec 29, 2025","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Firewall mode in tailscaled\r\n\r\nLast validated: Dec 29, 2025\r\n\r\nFirewall mode for [tailscaled](https://tailscale.com/docs/reference/tailscaled) refers to a router's selection among two firewall utilities,\r\n`iptables` and `nftables`, to manipulate firewalls (using [netfilter](https://tailscale.com/docs/reference/netfilter-modes)). This applies to Linux devices only. Up until Tailscale v1.48.0, Tailscale relied only on `iptables` to set firewall rules. As `nftables` is increasingly popular for its performance benefits, we added support to use `nftables` to manage Tailscale's firewall rules from the `nftables` Netlink API.\r\n\r\nOur way of manipulating firewall rules through `iptables` is by using the `iptables` binary. When Tailscale is running in `iptables` firewall mode, there must be a compatible `iptables` binary in the system `PATH`. On the other hand, we manipulate `nftables` through the `nftables` Netlink API, so it doesn't depend on the `nft` binary.\r\n\r\nThe use of `nftables` doesn't work in Tailscale when the Netlink API is disabled for [userspace networking mode](https://tailscale.com/docs/concepts/userspace-networking), which is not a common scenario.\r\n\r\n## [How to set the firewall mode](https://tailscale.com/docs/features/firewall-mode\\#how-to-set-the-firewall-mode)\r\n\r\nUsing the `TS_DEBUG_FIREWALL_MODE` environment variable to set the firewall mode is a temporary measure. Its use is subject to change and should not be considered as permanently supported.\r\n\r\nTailscale has a work-in-progress feature to detect whether the host system is currently using `iptables` or `nftables`\r\nso that it will also use the same firewall interface. It is possible to opt-in to this detection by setting the `TS_DEBUG_FIREWALL_MODE`\r\nenvironment variable to `auto`. It is also possible to explicitly test the specific firewall modes by setting `TS_DEBUG_FIREWALL_MODE`\r\nto one of the values below.\r\n\r\n| Value | Description |\r\n| --- | --- |\r\n| `auto` | A [heuristic](https://tailscale.com/docs/features/firewall-mode#heuristic) is used to decide between `iptables` and `nftables`. |\r\n| `iptables` | `iptables` is used. |\r\n| `nftables` | `nftables` is used. |\r\n| No value set | The default of `iptables` is used. |\r\n\r\nWhen using the `TS_DEBUG_FIREWALL_MODE` environment variable, set it in `/etc/default/tailscaled`.\r\n\r\n## [Firewall mode heuristic](https://tailscale.com/docs/features/firewall-mode\\#firewall-mode-heuristic)\r\n\r\nWhen `TS_DEBUG_FIREWALL_MODE` is set to `auto`, Tailscale will detect the firewall mode that other software on the system\r\nis already using. Tailscale will prefer `nftables` over `iptables` in the event that both are in use at the same time.\r\nWhen neither the `iptables` binary nor the `nftables` Netlink API are available, Tailscale will fall back to a degraded\r\noperation that may result in reduced performance or increased CPU usage. Packet filtering for traffic in and out of\r\nTailscale is always performed by packet filtering internal to Tailscale itself, so this configuration does not affect the\r\nsecurity of a Tailscale node or tailnet.\r\n\r\n## [Examples](https://tailscale.com/docs/features/firewall-mode\\#examples)\r\n\r\nTo set `iptables` as the firewall mode (this is the default if you don't set `TS_DEBUG_FIREWALL_MODE`):\r\n\r\n```shell\r\nTS_DEBUG_FIREWALL_MODE=iptables\r\n```\r\n\r\nTo set `nftables` as the firewall mode:\r\n\r\n```shell\r\nTS_DEBUG_FIREWALL_MODE=nftables\r\n```\r\n\r\nTo let Tailscale use the [heuristic](https://tailscale.com/docs/features/firewall-mode#heuristic) to set the firewall mode:\r\n\r\n```shell\r\nTS_DEBUG_FIREWALL_MODE=auto\r\n```\r\n\r\n## [How to verify it's working](https://tailscale.com/docs/features/firewall-mode\\#how-to-verify-its-working)\r\n\r\nIf you are running Tailscale outside of a container, you can verify the firewall mode by viewing the\r\n`tailscaled` log output via `journalctl`:\r\n\r\n```shell\r\njournalctl -ru tailscaled\r\n```\r\n\r\nIf you are running Tailscale inside a container, the way to view logs depends on the containerization\r\ntechnology being used.\r\n\r\nThe log should have three lines that start with `router:`, with the first line showing the rule count.\r\nThe second line shows the reason a firewall mode was chosen, and the third line shows the firewall\r\nmode currently in effect.\r\n\r\nThe log looks like the following when the `TS_DEBUG_FIREWALL_MODE` environment variable specifies\r\n`nftables`:\r\n\r\n```shell\r\nrouter: router: nftables rule count: 0, iptables rule count: 0\r\nrouter: router: envknob TS_DEBUG_FIREWALL_MODE=nftables set\r\nrouter: router: using nftables\r\n```\r\n\r\nSimilar output is shown when the `TS_DEBUG_FIREWALL_MODE` environment variable specifies `iptables`.\r\n\r\nWhen the firewall mode selection heuristic is used, the output looks like:\r\n\r\n```shell\r\nrouter: router: nftables rule count: 0, iptables rule count: 0\r\nrouter: router: nftables is available\r\nrouter: router: using nftables\r\n```\r\n\r\nThe possible reasons (shown in line 2 of the example output) are:\r\n\r\n- `iptables is available`\r\n- `iptables is currently in use`\r\n- `nftables is available`\r\n- `nftables is currently in use`\r\n\r\nWhen neither `iptables` or `nftables` is supported, `tailscaled` silently chooses `iptables`, and\r\ncreates a runner that doesn't do anything. This is a scenario that usually only advanced users\r\nexperience, when they don't need Tailscale to configure the firewall rules and they prefer to do it\r\nthemselves.\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"

Firewall mode in tailscaled

\n

Last validated: Dec 29, 2025

\n

Firewall mode for tailscaled refers to a router's selection among two firewall utilities,\r\niptables and nftables, to manipulate firewalls (using netfilter). This applies to Linux devices only. Up until Tailscale v1.48.0, Tailscale relied only on iptables to set firewall rules. As nftables is increasingly popular for its performance benefits, we added support to use nftables to manage Tailscale's firewall rules from the nftables Netlink API.

\n

Our way of manipulating firewall rules through iptables is by using the iptables binary. When Tailscale is running in iptables firewall mode, there must be a compatible iptables binary in the system PATH. On the other hand, we manipulate nftables through the nftables Netlink API, so it doesn't depend on the nft binary.

\n

The use of nftables doesn't work in Tailscale when the Netlink API is disabled for userspace networking mode, which is not a common scenario.

\n

How to set the firewall mode

\n

Using the TS_DEBUG_FIREWALL_MODE environment variable to set the firewall mode is a temporary measure. Its use is subject to change and should not be considered as permanently supported.

\n

Tailscale has a work-in-progress feature to detect whether the host system is currently using iptables or nftables\r\nso that it will also use the same firewall interface. It is possible to opt-in to this detection by setting the TS_DEBUG_FIREWALL_MODE\r\nenvironment variable to auto. It is also possible to explicitly test the specific firewall modes by setting TS_DEBUG_FIREWALL_MODE\r\nto one of the values below.

\n

| Value | Description |\r\n| --- | --- |\r\n| auto | A heuristic is used to decide between iptables and nftables. |\r\n| iptables | iptables is used. |\r\n| nftables | nftables is used. |\r\n| No value set | The default of iptables is used. |

\n

When using the TS_DEBUG_FIREWALL_MODE environment variable, set it in /etc/default/tailscaled.

\n

Firewall mode heuristic

\n

When TS_DEBUG_FIREWALL_MODE is set to auto, Tailscale will detect the firewall mode that other software on the system\r\nis already using. Tailscale will prefer nftables over iptables in the event that both are in use at the same time.\r\nWhen neither the iptables binary nor the nftables Netlink API are available, Tailscale will fall back to a degraded\r\noperation that may result in reduced performance or increased CPU usage. Packet filtering for traffic in and out of\r\nTailscale is always performed by packet filtering internal to Tailscale itself, so this configuration does not affect the\r\nsecurity of a Tailscale node or tailnet.

\n

Examples

\n

To set iptables as the firewall mode (this is the default if you don't set TS_DEBUG_FIREWALL_MODE):

\n
TS_DEBUG_FIREWALL_MODE=iptables\n
\n

To set nftables as the firewall mode:

\n
TS_DEBUG_FIREWALL_MODE=nftables\n
\n

To let Tailscale use the heuristic to set the firewall mode:

\n
TS_DEBUG_FIREWALL_MODE=auto\n
\n

How to verify it's working

\n

If you are running Tailscale outside of a container, you can verify the firewall mode by viewing the\r\ntailscaled log output via journalctl:

\n
journalctl -ru tailscaled\n
\n

If you are running Tailscale inside a container, the way to view logs depends on the containerization\r\ntechnology being used.

\n

The log should have three lines that start with router:, with the first line showing the rule count.\r\nThe second line shows the reason a firewall mode was chosen, and the third line shows the firewall\r\nmode currently in effect.

\n

The log looks like the following when the TS_DEBUG_FIREWALL_MODE environment variable specifies\r\nnftables:

\n
router: router: nftables rule count: 0, iptables rule count: 0\r\nrouter: router: envknob TS_DEBUG_FIREWALL_MODE=nftables set\r\nrouter: router: using nftables\n
\n

Similar output is shown when the TS_DEBUG_FIREWALL_MODE environment variable specifies iptables.

\n

When the firewall mode selection heuristic is used, the output looks like:

\n
router: router: nftables rule count: 0, iptables rule count: 0\r\nrouter: router: nftables is available\r\nrouter: router: using nftables\n
\n

The possible reasons (shown in line 2 of the example output) are:

\n\n

When neither iptables or nftables is supported, tailscaled silently chooses iptables, and\r\ncreates a runner that doesn't do anything. This is a scenario that usually only advanced users\r\nexperience, when they don't need Tailscale to configure the firewall rules and they prefer to do it\r\nthemselves.

\n

\"Project

\n

Ask AI

\n

reCAPTCHA

\n

Recaptcha requires verification.

\n

protected by reCAPTCHA

\n"}