Bug 2453924

Summary:	drop hard dependency on iptables from tailscale
Product:	[Fedora] Fedora	Reporter:	Dennis Schridde <heri>
Component:	tailscale	Assignee:	Jonathan Wright <jonathan>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	43	CC:	go-sig, jonathan
Target Milestone:	---
Target Release:	---
Hardware:	x86_64
OS:	Linux
URL:	https://tailscale.com/docs/features/firewall-mode
Whiteboard:
Fixed In Version:	tailscale-1.98.4-1.fc45 tailscale-1.98.4-1.fc44	Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2026-05-31 13:17:32 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Dennis Schridde 2026-04-01 18:00:41 UTC

Since version 1.48.0 Tailscale should support other firewall implementations than iptables, namely nftables, see https://tailscale.com/docs/features/firewall-mode.  But the Fedora package still requires iptables to be installed:

❯ sudo dnf remove iptables-nft
Package                                                          Arch           Version                                                          Repository                                Size
Removing:
 iptables-nft                                                    x86_64         1.8.11-12.fc43                                                   <unknown>                            464.1 KiB
Removing dependent packages:
 iptstate                                                        x86_64         2.2.7-10.fc43                                                    fedora                                95.3 KiB
 tailscale                                                       x86_64         1.94.2-1.fc43                                                    updates                               47.0 MiB

See https://src.fedoraproject.org/rpms/tailscale/blob/f43/f/tailscale.spec#_41 for the hard dependency in the RPM spec file (it's the same also in rawhide).

Reproducible: Always

Comment 1 Dennis Schridde 2026-04-01 19:08:09 UTC

I can confirm that tailscale still works after:
```
$ dnf download iptables-nft
$ sudo dnf remove iptables-nft
$ sudo rpm -i --justdb iptables-nft-1.8.11-12.fc43.x86_64.rpm
$ sudo dnf install tailscale
$ which iptables
/usr/bin/which: no iptables in [...]
$ sudo systemctl start tailscaled
$ sudo systemctl enable tailscaled
$ systemctl --user start tailscale-systray
$ systemctl --user enable tailscale-systray
```

`sudo nft list ruleset` no longer shows "Warning: table [...] is managed by iptables-nft, do not touch!"

Comment 2 Fedora Update System 2026-05-31 13:14:23 UTC

FEDORA-2026-c3b7c062a3 (tailscale-1.98.4-1.fc45) has been submitted as an update to Fedora 45.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-c3b7c062a3

Comment 3 Fedora Update System 2026-05-31 13:16:35 UTC

FEDORA-2026-07897c0238 (tailscale-1.98.4-1.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-07897c0238

Comment 4 Fedora Update System 2026-05-31 13:17:32 UTC

FEDORA-2026-c3b7c062a3 (tailscale-1.98.4-1.fc45) has been pushed to the Fedora 45 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 5 Fedora Update System 2026-06-01 01:20:47 UTC

FEDORA-2026-07897c0238 has been pushed to the Fedora 44 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-07897c0238`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-07897c0238

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 6 Fedora Update System 2026-06-09 01:22:01 UTC

FEDORA-2026-07897c0238 (tailscale-1.98.4-1.fc44) has been pushed to the Fedora 44 stable repository.
If problem still persists, please make note of it in this bug report.