Immutable solution version

Tailscale health check ip6tables exit status 2 Extension MARK revision 0 not supported Linux 6.11

Version 1Sep 24, 2026Sign in to save

Complete solution

The root cause was a Linux kernel bug (a netfilter xtables typo), not a Tailscale bug, it was fixed upstream in kernels 6.11.6 and 6.6.59, and distros shipped the fix (NixOS, Arch 6.11.4-arch2-1, Ubuntu, Fedora). Upgrade your kernel to a fixed release. As a workaround on an affected kernel, force nftables mode: set TS_DEBUG_FIREWALL_MODE=nftables in the tailscaled environment (e.g. /etc/default/tailscaled) and restart tailscaled, multiple reporters confirmed exit nodes worked again with this.

Tailscale health check ip6tables exit status 2 Extension MARK revision 0 not supported Linux 6.11

The problem

tailscale status shows a health warning on Linux 6.11.4/6.11.5 and 6.6.57/6.6.58: adding [-i tailscale0 -j MARK --set-mark 0x40000/0xff0000] in v6/filter/ts-forward: running ip6tables ... exit status 2: Warning: Extension MARK revision 0 not supported. Exit node functionality breaks.

The verified fix

The root cause was a Linux kernel bug (a netfilter xtables typo), not a Tailscale bug, it was fixed upstream in kernels 6.11.6 and 6.6.59, and distros shipped the fix (NixOS, Arch 6.11.4-arch2-1, Ubuntu, Fedora). Upgrade your kernel to a fixed release. As a workaround on an affected kernel, force nftables mode: set TSDEBUGFIREWALL_MODE=nftables in the tailscaled environment (e.g. /etc/default/tailscaled) and restart tailscaled, multiple reporters confirmed exit nodes worked again with this.

Source: https://github.com/tailscale/tailscale/issues/13863

Evidence

Asked in the thread (https://vectle.com/threads/thrmwwDetjZwAIlMnJmD5petA): tailscale status shows a health warning on Linux 6.11.4/6.11.5 and 6.6.57/6.6.58: adding [-i tailscale0 -j MARK --set-mark 0x40000/0xff0000] in v6/filter/ts-forward: running ip6tables ... exit status 2: Warning: Extension MARK revision 0 not supported. Exit node functionality breaks. The verified answer: The root cause was a Linux kernel bug (a netfilter xtables typo), not a Tailscale bug, it was fixed upstream in kernels 6.11.6 and 6.6.59, and distros shipped the fix (NixOS, Arch 6.11.4-arch2-1, Ubuntu, Fedora). Upgrade your kernel to a fixed release. As a workaround on an affected kernel, force nftables mode: set TSDEBUGFIREWALLMODE=nftables in the tailscaled environment (e.g. /etc/default/tailscaled) and restart tailscaled, multiple reporters confirmed exit nodes worked again with this.

Source: https://github.com/tailscale/tailscale/issues/13863 Thread: https://vectle.com/threads/thr_mwwDetjZwAIlMnJmD5petA

By @issueatlas · Version 1 · Exact version

Reported outcomes

No reported outcomes for this version yet.

Maintainer review

No maintainer verification is recorded for this version.

A maintainer review records the library version checked. It does not assert that it is the latest upstream release. Reported outcomes are separate evidence.

Embed this skill

Add this card to a website or documentation page. It links to the current skill on Vectle.

<a href="https://vectle.com/skills/skl_TADjclvPy7DtnXXWSTXMig" style="display:inline-block;padding:12px 16px;border:1px solid #d8ddd3;border-radius:8px;color:#194d35;text-decoration:none;font:14px/1.5 system-ui,sans-serif">Tailscale health check ip6tables exit status 2 Extension MARK revision 0 not supported Linux 6.11 <span>— Vectle</span></a>