Tailscale health check ip6tables exit status 2 Extension MARK revision 0 not supported Linux 6.11

TL;DR

Upgrade your kernel to a fixed release. The root cause was a Linux kernel bug (a netfilter xtables typo), not a Tailscale bug, it was fixed upstream in kernels 6.11.6 and 6.6.59, and distros shipped the fix (NixOS, Arch 6.11.4-arch2-1, Ubuntu, Fedora).

Steps

1. The root cause was a Linux kernel bug (a netfilter xtables typo), not a Tailscale bug, it was fixed upstream in kernels 6.11.6 and 6.6.59, and distros shipped the fix (NixOS, Arch 6.11.4-arch2-1, Ubuntu, Fedora). Upgrade your kernel to a fixed release. As a workaround on an affected kernel, force nftables mode: set TSDEBUGFIREWALL_MODE=nftables in the tailscaled environment (e.g. /etc/default/tailscaled) and restart tailscaled, multiple reporters confirmed exit nodes worked again with this.

When to use

You are seeing this: tailscale status shows a health warning on Linux 6.11.4/6.11.5 and 6.6.57/6.6.58: adding [-i tailscale0 -j MARK --set-mark 0x40000/0xff0000] in v6/filter/ts-forward: running ip6tables... exit status 2: Warning: Extension MARK revision 0 not supported. Use this skill when you run into "Tailscale health check ip6tables exit status 2 Extension MARK revision 0 not supported Linux 6.11".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

Versions mentioned in the source: Linux 6.11.4, 6.11.4 6.11.5, 6.6.57, 6.6.57 6.6.58, kernels 6.11.6, 6.6.59, Arch 6.11.4-arch2. If you are on something much newer or older, the details may have shifted.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Asked in the thread (https://vectle.com/threads/thrmwwDetjZwAIlMnJmD5petA): tailscale status shows a health warning on Linux 6.11.4/6.11.5 and 6.6.57/6.6.58: adding [-i tailscale0 -j MARK --set-mark 0x40000/0xff0000] in v6/filter/ts-forward: running ip6tables ... exit status 2: Warning: Extension MARK revision 0 not supported. Exit node functionality breaks. The verified answer: The root cause was a Linux kernel bug (a netfilter xtables typo), not a Tailscale bug, it was fixed upstream in kernels 6.11.6 and 6.6.59, and distros shipped the fix (NixOS, Arch 6.11.4-arch2-1, Ubuntu, Fedora). Upgrade your kernel to a fixed release. As a workaround on an affected kernel, force nftables mode: set TSDEBUGFIREWALLMODE=nftables in the tailscaled environment (e.g. /etc/default/tailscaled) and restart tailscaled, multiple reporters confirmed exit nodes worked again with this.

Source: https://github.com/tailscale/tailscale/issues/13863 Thread: https://vectle.com/threads/thr_mwwDetjZwAIlMnJmD5petA