Hi,

I’m trying to run an official Tailscale container. The Tailscale software works correct, but in order to enable proper forwarding it tries to create a firewall rule inside the container and fails.

Command:

iptables -t filter -A ts-forward -i tailscale0 -j MARK --set-mark 0x40000/0xff0000 --wait

Error:

exit status 1: iptables: Invalid argument. Run `dmesg' for more information

Output of iptables -S when the container is running:

-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N ts-forward
-N ts-input
-A INPUT -j ts-input
-A FORWARD -j ts-forward
-A ts-input -s 100.115.92.0/23 ! -i tailscale0 -j RETURN
-A ts-input -s 100.64.0.0/10 ! -i tailscale0 -j DROP
-A ts-input -i tailscale0 -j ACCEPT

Unfortunately, dmesg can't be run inside the container (forbidden?). Although xt_mark is listed as a loaded kernel module by lsmod command, the system seems to lack packet marking capability.

Critical environment variables:

• TS_AUTHKEY = auth key, generated at https://login.tailscale.com/admin/settings/keys
• TS_USERSPACE = false, to enable tailscale0 device creation (otherwise it runs as a userspace proxy, not what I need).

I reported the problem to MikroTik support (SUP-138792) and received the following answer:

Currently, there are no available iptables for third-party code. We will explore possible solutions if we receive similar requests from our clients. We are sorry for the inconvenience caused.

For all those users who are interested in Tailscale and other containers using iptables, please, submit your requests via the support portal.

I'm dealing with the same problem with https://github.com/Fluent-networks/tailscale-mikrotik
Were you lucky with yours?

Were you lucky with yours?

As mentioned above, I approached the support and received a confirmation of this issue. You may also submit a new ticket and tell them you are interested in allowing iptables inside containers as well.