{"record":{"id":"034911800ccc5fc7","repo":"netbirdio/netbird","slug":"reset-v6-acl-manager-w","errorCode":null,"errorMessage":"reset v6 acl manager: %w","messagePattern":"reset v6 acl manager: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"client/firewall/iptables/manager_linux.go","lineNumber":345,"sourceCode":"\t\treturn firewall.SetLegacyManagement(m.router6, isLegacy)\n\t}\n\treturn nil\n}\n\n// Reset firewall to the default state\nfunc (m *Manager) Close(stateManager *statemanager.Manager) error {\n\tm.mutex.Lock()\n\tdefer m.mutex.Unlock()\n\n\tvar merr *multierror.Error\n\n\tif err := m.cleanupNoTrackChain(); err != nil {\n\t\tmerr = multierror.Append(merr, fmt.Errorf(\"cleanup notrack chain: %w\", err))\n\t}\n\n\tif m.hasIPv6() {\n\t\tif err := m.aclMgr6.Reset(); err != nil {\n\t\t\tmerr = multierror.Append(merr, fmt.Errorf(\"reset v6 acl manager: %w\", err))\n\t\t}\n\t\tif err := m.router6.Reset(); err != nil {\n\t\t\tmerr = multierror.Append(merr, fmt.Errorf(\"reset v6 router: %w\", err))\n\t\t}\n\t}\n\n\tif err := m.aclMgr.Reset(); err != nil {\n\t\tmerr = multierror.Append(merr, fmt.Errorf(\"reset acl manager: %w\", err))\n\t}\n\tif err := m.router.Reset(); err != nil {\n\t\tmerr = multierror.Append(merr, fmt.Errorf(\"reset router: %w\", err))\n\t}\n\n\t// Appending to merr intentionally blocks DeleteState below so ShutdownState\n\t// stays persisted and the crash-recovery path retries firewalld cleanup.\n\tif err := firewalld.UntrustInterface(m.wgIface.Name()); err != nil {\n\t\tmerr = multierror.Append(merr, err)\n\t}","sourceCodeStart":327,"sourceCodeEnd":363,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/firewall/iptables/manager_linux.go#L327-L363","documentation":"During Manager.Close, aclMgr6.Reset() failed - removing the v6 ACL chains (NETBIRD-ACL-INPUT), optional mangle entries, and v6 ipsets. The error is accumulated into the multierror and the remaining steps (v6 router, v4 acl, v4 router) still run; the persisted ShutdownState is deliberately kept so crash recovery retries. Removal order is v6-first so v4 cleanup is unaffected.","triggerScenarios":"Close on a manager with hasIPv6() true where an ip6tables or ipset delete fails: chains already flushed by an external tool, ipset in use, or the process lost privileges.","commonSituations":"Double cleanup (previous crash-recovery already removed chains); firewalld/ip6tables-restore rewrites during shutdown; unprivileged stop.","solutions":["Rerun Close or restart-then-stop the agent; ShutdownState.Cleanup on next start finishes the job idempotently","Verify no v6 leftovers: ip6tables -S | grep NETBIRD and ipset list | grep -i netbird","Manually flush/remove leftover NETBIRD v6 chains if the host must be cleaned immediately"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"closeErr := mgr.Close(stateManager)\nif closeErr != nil {\n    var merr *multierror.Error\n    if errors.As(closeErr, &merr) {\n        for _, e := range merr.Errors {\n            if strings.Contains(e.Error(), \"reset v6 acl manager\") {\n                log.Debugf(\"v6 ACL teardown partial (retried on next start): %v\", e)\n            }\n        }\n    }\n}","preventionTips":["Rely on next-startup Cleanup for leftover v6 ACL chains rather than force-deleting by hand","Serialize agent stop with external firewall tooling to avoid flush races","Check ip6tables -S | grep NETBIRD after abnormal exits"],"tags":["iptables","ipv6","firewall","acl","cleanup","netbird","go"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}