{"record":{"id":"1ba41a7becc38b79","repo":"netbirdio/netbird","slug":"flush-remove-nat-rules-s-w","errorCode":null,"errorMessage":"flush remove nat rules %s: %w","messagePattern":"flush remove nat rules (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/firewall/nftables/router_linux.go","lineNumber":1489,"sourceCode":"\n\tif pair.Masquerade {\n\t\tif err := r.removeNatRule(pair); err != nil {\n\t\t\tmerr = multierror.Append(merr, fmt.Errorf(\"remove prerouting rule: %w\", err))\n\t\t}\n\n\t\tif err := r.removeNatRule(firewall.GetInversePair(pair)); err != nil {\n\t\t\tmerr = multierror.Append(merr, fmt.Errorf(\"remove inverse prerouting rule: %w\", err))\n\t\t}\n\t}\n\n\tif err := r.removeLegacyRouteRule(pair); err != nil {\n\t\tmerr = multierror.Append(merr, fmt.Errorf(\"remove legacy routing rule: %w\", err))\n\t}\n\n\t// Set counters are decremented in the sub-methods above before flush. If flush fails,\n\t// counters will be off until the next successful removal or refresh cycle.\n\tif err := r.conn.Flush(); err != nil {\n\t\tmerr = multierror.Append(merr, fmt.Errorf(\"flush remove nat rules %s: %w\", pair.Destination, err))\n\t}\n\n\treturn nberrors.FormatErrorOrNil(merr)\n}\n\nfunc (r *router) removeNatRule(pair firewall.RouterPair) error {\n\truleKey := firewall.GenKey(firewall.PreroutingFormat, pair)\n\n\trule, exists := r.rules[ruleKey]\n\tif !exists {\n\t\tlog.Debugf(\"prerouting rule %s not found\", ruleKey)\n\t\treturn nil\n\t}\n\n\tif rule.Handle == 0 {\n\t\tlog.Warnf(\"prerouting rule %s has no handle, removing stale entry\", ruleKey)\n\t\tif err := r.decrementSetCounter(rule); err != nil {\n\t\t\tlog.Warnf(\"decrement set counter for stale rule %s: %v\", ruleKey, err)","sourceCodeStart":1471,"sourceCodeEnd":1507,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/firewall/nftables/router_linux.go#L1471-L1507","documentation":"Error \"flush remove nat rules %s: %w\" thrown in netbirdio/netbird.","triggerScenarios":"Thrown at client/firewall/nftables/router_linux.go:1489 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}