Bug 2453924 - drop hard dependency on iptables from tailscale
Summary: drop hard dependency on iptables from tailscale
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: tailscale
Version: 43
Hardware: x86_64
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Jonathan Wright
QA Contact:
URL: https://tailscale.com/docs/features/f...
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-04-01 18:00 UTC by Dennis Schridde
Modified: 2026-06-09 01:22 UTC (History)
2 users (show)

Fixed In Version: tailscale-1.98.4-1.fc45 tailscale-1.98.4-1.fc44
Clone Of:
Environment:
Last Closed: 2026-05-31 13:17:32 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github tailscale tailscale issues 14063 0 None open tailscale package depends iptables causes always use iptables instead nftables on ubuntu 2026-04-01 18:02:31 UTC

Description Dennis Schridde 2026-04-01 18:00:41 UTC
Since version 1.48.0 Tailscale should support other firewall implementations than iptables, namely nftables, see https://tailscale.com/docs/features/firewall-mode.  But the Fedora package still requires iptables to be installed:

❯ sudo dnf remove iptables-nft
Package                                                          Arch           Version                                                          Repository                                Size
Removing:
 iptables-nft                                                    x86_64         1.8.11-12.fc43                                                   <unknown>                            464.1 KiB
Removing dependent packages:
 iptstate                                                        x86_64         2.2.7-10.fc43                                                    fedora                                95.3 KiB
 tailscale                                                       x86_64         1.94.2-1.fc43                                                    updates                               47.0 MiB

See https://src.fedoraproject.org/rpms/tailscale/blob/f43/f/tailscale.spec#_41 for the hard dependency in the RPM spec file (it's the same also in rawhide).

Reproducible: Always

Comment 1 Dennis Schridde 2026-04-01 19:08:09 UTC
I can confirm that tailscale still works after:
```
$ dnf download iptables-nft
$ sudo dnf remove iptables-nft
$ sudo rpm -i --justdb iptables-nft-1.8.11-12.fc43.x86_64.rpm
$ sudo dnf install tailscale
$ which iptables
/usr/bin/which: no iptables in [...]
$ sudo systemctl start tailscaled
$ sudo systemctl enable tailscaled
$ systemctl --user start tailscale-systray
$ systemctl --user enable tailscale-systray
```

`sudo nft list ruleset` no longer shows "Warning: table [...] is managed by iptables-nft, do not touch!"

Comment 2 Fedora Update System 2026-05-31 13:14:23 UTC
FEDORA-2026-c3b7c062a3 (tailscale-1.98.4-1.fc45) has been submitted as an update to Fedora 45.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-c3b7c062a3

Comment 3 Fedora Update System 2026-05-31 13:16:35 UTC
FEDORA-2026-07897c0238 (tailscale-1.98.4-1.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-07897c0238

Comment 4 Fedora Update System 2026-05-31 13:17:32 UTC
FEDORA-2026-c3b7c062a3 (tailscale-1.98.4-1.fc45) has been pushed to the Fedora 45 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 5 Fedora Update System 2026-06-01 01:20:47 UTC
FEDORA-2026-07897c0238 has been pushed to the Fedora 44 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-07897c0238`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-07897c0238

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 6 Fedora Update System 2026-06-09 01:22:01 UTC
FEDORA-2026-07897c0238 (tailscale-1.98.4-1.fc44) has been pushed to the Fedora 44 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.