What causes "%s" in OpenNHP/opennhp?

Run the process as root or grant NET_ADMIN capability (docker --cap-add=NET_ADMIN)

%s

Error message

%s

What it means

The Run helper in nhp/utils/iptables.go executes an iptables command via os/exec and treats any non-empty stderr as a command failure, wrapping stderr verbatim ('%s'). So this error message carries the raw iptables stderr output, e.g. permission denied, chain not found, or bad rule syntax. Callers (Add) get it whenever the iptables binary exits 0 but wrote to stderr, or fails with stderr content.

Solutions

Run the process as root or grant NET_ADMIN capability (docker --cap-add=NET_ADMIN)
Verify iptables/nft iptables is installed and the correct backend (iptables-legacy vs iptables-nft)
Inspect the returned stderr text — it is the literal iptables diagnostic — and fix the rule arguments
Pre-validate rule parameters (IPs/ports) before invoking

Example fix

// before
out, err := Run("iptables", "-A", chain, "-p", proto, "-s", badIP, "-j", "DROP")
// after
if net.ParseIP(badIP) == nil { return fmt.Errorf("invalid rule ip %q", badIP) }
out, err := Run("iptables", "-A", chain, "-p", proto, "-s", badIP, "-j", "DROP")

Defensive patterns

Strategy: try-catch

Validate before calling

if _, err := exec.LookPath("iptables"); err != nil { return fmt.Errorf("iptables not installed") }

Try / catch

out, err := iptables.Run(args...); if err != nil { log.Error("iptables failed: %s", err.Error()) /* stderr text embedded */; return err }

Prevention

Run daemons needing iptables as root or with NET_ADMIN capability
Verify iptables backend (legacy vs nft) on the target image
Log the returned error verbatim — it contains iptables' own stderr
Validate rule IPs/ports before building commands

When it happens

Trigger: iptables not installed (command lookup failure surfaces separately); running without root (stderr: 'Permission denied (you must be root)'); referencing a missing chain; malformed rule arguments; iptables binary present but exiting with stderr diagnostics.

Common situations: Deploying nhp-ac in an unprivileged container without NET_ADMIN capability; missing iptables binaries on minimal images (need iptables-legacy vs nft); rule strings built from bad config values.

Related errors

AI-assisted analysis of OpenNHP/opennhp@6e04ca5ff0 (2026-09-07). Data as JSON: /api/errors/3fabc4b0a46c6c5c. Report an issue: GitHub.

Appendix: source

Thrown at nhp/utils/iptables.go:473

	}
	return name
}

func (ipset *IPSet) Run(ctx context.Context, args ...string) (string, error) {
	c := make(chan string)
	defer close(c)
	var stderr bytes.Buffer
	var stdout bytes.Buffer

	cmd := exec.CommandContext(ctx, ipset.Binary, args...)
	cmd.Stderr = &stderr
	cmd.Stdout = &stdout
	err := cmd.Run()
	if err != nil {
		return "", err
	}
	if stderr.String() != "" {
		return "", fmt.Errorf("%s", stderr.String())
	}
	return stdout.String(), nil
}

View on GitHub (pinned to 6e04ca5ff0)