ip6tables Extension MARK revision 0 not supported after Linux 6.11.4 update

Fix ip6tables "Extension MARK revision 0 not supported" after a kernel update

TL;DR: Kernels 6.11.4 and 6.6.57 broke the MARK match Tailscale uses for IPv6 forwarding rules. Upgrade to 6.11.5+ or 6.6.58+ and the health warning goes away. If you do not use IPv6, you can also just ignore it.

The error

# Health check:
#     - adding [-i tailscale0 -j MARK --set-mark 0x40000/0xff0000] in v6/filter/ts-forward: [... ip6tables -t filter -A ts-forward -i tailscale0 -j MARK --set-mark 0x40000/0xff0000 --wait]: exit status 2: Warning: Extension MARK revision 0 not supported, missing kernel module?

Shows up in tailscale status right after a kernel upgrade. IPv4 rules are fine; only the v6 chain fails.

Fix it

1. Check your kernel version

uname -r

Expected: 6.11.4, 6.11.5-ish, 6.6.57, or 6.6.58-ish. The bad ones are 6.11.4 and 6.6.57.

2. Upgrade the kernel past the regression

• If on 6.11.4, go to 6.11.5 or newer.
• If on 6.6.57, go to 6.6.58 or newer.

Use your distro or NixOS channel update, then reboot.

Expected after reboot: tailscale status shows no health warnings.

3. Confirm the MARK rule applies cleanly

tailscale status | head -5

Expected: no # Health check: block. IPv6 forwarding through the tailnet works again.

When this applies

• tailscale status shows the MARK / missing kernel module warning in v6/filter/ts-forward
• It started right after a kernel update to 6.11.4 or 6.6.57
• modprobe for the mark module does not help (the module is not the problem)

When it does not apply

• IPv4 iptables errors (different chain, different cause)
• MARK errors on much older kernels (check your iptables install instead)
• Tailscale fails to start entirely (not a health-warning-only situation)

Tool compatibility

Tailscale 1.7x on Linux with kernels 6.11.4 / 6.6.57. Reported on NixOS; any distro shipping those exact kernel builds is affected.

Variant phrasings

ip6tables v1.8.x: exit status 2 on ts-forward

Same failure, shorter form. The exit status 2 plus the MARK warning is the signature.

Why it happens

Those two kernel releases regressed the xt_mark match revision that ip6tables 1.8.x asks for, so the rule insert fails even though the module is present. It is a kernel bug, not a Tailscale bug, which is why the fix is a kernel upgrade.

Edge cases

• No IPv6 in use: the failing chain is v6-only. If your tailnet is IPv4-only you can live with the warning, but upgrading is still cleaner.
• NixOS: the fix PRs were tracked in nixpkgs; a channel update past the fixed kernel is all it takes.
• Still broken after upgrade: make sure you actually booted the new kernel (uname -r), not just installed it.