{"record":{"id":"24c085b4155f6955","repo":"netbirdio/netbird","slug":"add-legacy-forwarding-rule-s-s-v","errorCode":null,"errorMessage":"add legacy forwarding rule %s -> %s: %v","messagePattern":"add legacy forwarding rule (.+?) -> (.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/firewall/iptables/router_linux.go","lineNumber":322,"sourceCode":"\t\treturn fmt.Errorf(\"remove legacy routing rule: %w\", err)\n\t}\n\n\tr.updateState()\n\n\treturn nil\n}\n\n// addLegacyRouteRule adds a legacy routing rule for mgmt servers pre route acls\nfunc (r *router) addLegacyRouteRule(pair firewall.RouterPair) error {\n\truleKey := firewall.GenKey(firewall.ForwardingFormat, pair)\n\n\tif err := r.removeLegacyRouteRule(pair); err != nil {\n\t\treturn err\n\t}\n\n\trule := []string{\"-s\", pair.Source.String(), \"-d\", pair.Destination.String(), \"-j\", routingFinalForwardJump}\n\tif err := r.iptablesClient.Append(tableFilter, chainRTFWDIN, rule...); err != nil {\n\t\treturn fmt.Errorf(\"add legacy forwarding rule %s -> %s: %v\", pair.Source, pair.Destination, err)\n\t}\n\n\tr.rules[ruleKey] = rule\n\n\treturn nil\n}\n\nfunc (r *router) removeLegacyRouteRule(pair firewall.RouterPair) error {\n\truleKey := firewall.GenKey(firewall.ForwardingFormat, pair)\n\n\tif rule, exists := r.rules[ruleKey]; exists {\n\t\tif err := r.iptablesClient.DeleteIfExists(tableFilter, chainRTFWDIN, rule...); err != nil {\n\t\t\treturn fmt.Errorf(\"remove legacy forwarding rule %s -> %s: %v\", pair.Source, pair.Destination, err)\n\t\t}\n\t\tdelete(r.rules, ruleKey)\n\n\t\tif err := r.decrementSetCounter(rule); err != nil {\n\t\t\treturn fmt.Errorf(\"decrement ipset counter: %w\", err)","sourceCodeStart":304,"sourceCodeEnd":340,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/firewall/iptables/router_linux.go#L304-L340","documentation":"Returned by router.addLegacyRouteRule when iptablesClient.Append(tableFilter, NETBIRD-RT-FWD-IN, '-s <src> -d <dst> -j ACCEPT') fails while installing the permissive legacy rule for pre-route-ACL management. Formatted with %v (not %w), so the cause is embedded as text and is not unwrappable by callers. The rule allows all traffic from pair.Source to pair.Destination, which is why the warning above it matters.","triggerScenarios":"AddNatRule with legacyManagement on, after a successful removeLegacyRouteRule. Append fails when NETBIRD-RT-FWD-IN does not exist (init/createContainers failed or chains were flushed), CAP_NET_ADMIN is missing, or the iptables invocation errors.","commonSituations":"Old management version plus a host where custom chains were removed manually or by a crashed run; containers where capabilities were dropped after start; nft backend mismatch producing 'No chain/target/match by that name'.","solutions":["Ensure NETBIRD-RT-FWD-IN exists (sudo iptables -S NETBIRD-RT-FWD-IN); restart agent to re-init if missing","Check the log for the earlier createContainers/init failure and fix root cause first","Upgrade management so the peer leaves legacy mode and uses route ACLs instead","Confirm root/CAP_NET_ADMIN for the agent process"],"exampleFix":"// before (router_linux.go:322): cause not wrappable\nreturn fmt.Errorf(\"add legacy forwarding rule %s -> %s: %v\", pair.Source, pair.Destination, err)\n// after\nreturn fmt.Errorf(\"add legacy forwarding rule %s -> %s: %w\", pair.Source, pair.Destination, err)","handlingStrategy":"validation","validationCode":"if ok, _ := r.iptablesClient.ChainExists(tableFilter, chainRTFWDIN); !ok {\n\treturn fmt.Errorf(\"chain %s missing; run init first\", chainRTFWDIN)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Fix createContainers failures before any AddNatRule in legacy mode","Upgrade management to leave legacy mode","Note the %v format: match on message text if you must detect it"],"tags":["iptables","legacy","linux","netbird","error-wrapping"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}