{"record":{"id":"22fdfe3d828cf8e4","repo":"netbirdio/netbird","slug":"check-chain-s-in-table-s-w","errorCode":null,"errorMessage":"check chain %s in table %s: %w","messagePattern":"check chain (.+?) in table (.+?): %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"client/firewall/iptables/router_linux.go","lineNumber":428,"sourceCode":"\t\t\tlog.Debugf(\"clean OUTPUT jump rule: %v\", err)\n\t\t}\n\t}\n\n\tfor _, chainInfo := range []struct {\n\t\tchain string\n\t\ttable string\n\t}{\n\t\t{chainRTFWDIN, tableFilter},\n\t\t{chainRTFWDOUT, tableFilter},\n\t\t{chainRTPRE, tableMangle},\n\t\t{chainRTNAT, tableNat},\n\t\t{chainRTRDR, tableNat},\n\t\t{chainNATOutput, tableNat},\n\t\t{chainRTMSSCLAMP, tableMangle},\n\t} {\n\t\tok, err := r.iptablesClient.ChainExists(chainInfo.table, chainInfo.chain)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"check chain %s in table %s: %w\", chainInfo.chain, chainInfo.table, err)\n\t\t} else if ok {\n\t\t\tif err = r.iptablesClient.ClearAndDeleteChain(chainInfo.table, chainInfo.chain); err != nil {\n\t\t\t\treturn fmt.Errorf(\"clear and delete chain %s in table %s: %w\", chainInfo.chain, chainInfo.table, err)\n\t\t\t}\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc (r *router) createContainers() error {\n\tfor _, chainInfo := range []struct {\n\t\tchain string\n\t\ttable string\n\t}{\n\t\t{chainRTFWDIN, tableFilter},\n\t\t{chainRTFWDOUT, tableFilter},\n\t\t{chainRTPRE, tableMangle},","sourceCodeStart":410,"sourceCodeEnd":446,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/firewall/iptables/router_linux.go#L410-L446","documentation":"Returned by router.cleanUpDefaultForwardRules inside its loop over the seven NetBird custom chains (NETBIRD-RT-FWD-IN/OUT in filter, NETBIRD-RT-PRE and NETBIRD-RT-MSSCLAMP in mangle, NETBIRD-RT-NAT/RDR/NAT-OUTPUT in nat) when iptablesClient.ChainExists errors for one of them. Like error 554 this is a failed query about the chain, not the chain being absent (absent returns ok=false and is skipped).","triggerScenarios":"Init cleanup or Reset iterating the chain list; the ChainExists lookup on one table/chain fails because the iptables binary cannot execute or list that table (missing kernel table support, lock, permissions).","commonSituations":"Minimal kernels without nat/mangle table support (some containers, WSL1-era); iptables-nft with a broken ruleset; lock contention with other firewall tooling during startup.","solutions":["Reproduce per table: sudo iptables -S; sudo iptables -t nat -S; sudo iptables -t mangle -S","Install/verify iptables + conntrack/nft packages in containers","Load table support (modprobe iptable_nat iptable_mangle iptable_filter) or enable in kernel config","Retry agent start once lock contention clears"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"# verify every table the manager touches is listable\nfor t in filter nat mangle; do sudo iptables -t $t -S >/dev/null || echo \"table $t broken\"; done","typeGuard":null,"tryCatchPattern":"ok, err := r.iptablesClient.ChainExists(chainInfo.table, chainInfo.chain)\nif err != nil {\n\t// record and continue: a broken query on one table should not skip the rest\n\tmerr = multierror.Append(merr, fmt.Errorf(\"check chain %s in table %s: %w\", chainInfo.chain, chainInfo.table, err))\n\tcontinue\n}","preventionTips":["Enable iptable_filter/nat/mangle in kernel or container image","Run table probes as a preflight in deployment","Collect per-table errors instead of aborting the loop"],"tags":["iptables","cleanup","linux","netbird","kernel-modules"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}