{"record":{"id":"273ca35e72aeed01","repo":"netbirdio/netbird","slug":"list-chains-w","errorCode":null,"errorMessage":"list chains: %w","messagePattern":"list chains: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/firewall/iptables/acl_linux.go","lineNumber":288,"sourceCode":"\t\t}\n\n\t\tfor _, rule := range m.entries[\"FORWARD\"] {\n\t\t\terr := m.iptablesClient.DeleteIfExists(tableName, \"FORWARD\", rule...)\n\t\t\tif err != nil {\n\t\t\t\tlog.Errorf(\"failed to delete rule: %v, %s\", rule, err)\n\t\t\t}\n\t\t}\n\n\t\terr = m.iptablesClient.ClearAndDeleteChain(tableName, chainNameInputRules)\n\t\tif err != nil {\n\t\t\tlog.Debugf(\"failed to clear and delete %s chain: %s\", chainNameInputRules, err)\n\t\t\treturn err\n\t\t}\n\t}\n\n\tok, err = m.iptablesClient.ChainExists(\"mangle\", \"PREROUTING\")\n\tif err != nil {\n\t\treturn fmt.Errorf(\"list chains: %w\", err)\n\t}\n\tif ok {\n\t\tfor _, rule := range m.entries[\"PREROUTING\"] {\n\t\t\terr := m.iptablesClient.DeleteIfExists(\"mangle\", \"PREROUTING\", rule...)\n\t\t\tif err != nil {\n\t\t\t\tlog.Errorf(\"failed to delete rule: %v, %s\", rule, err)\n\t\t\t}\n\t\t}\n\t}\n\n\tfor _, rule := range m.entries[mangleFwdKey] {\n\t\tif err := m.iptablesClient.DeleteIfExists(tableMangle, chainFORWARD, rule...); err != nil {\n\t\t\tlog.Errorf(\"failed to delete mangle FORWARD guard rule: %v, %s\", rule, err)\n\t\t}\n\t}\n\n\tfor _, ipsetName := range m.ipsetStore.ipsetNames() {\n\t\tif err := m.flushIPSet(ipsetName); err != nil {","sourceCodeStart":270,"sourceCodeEnd":306,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/firewall/iptables/acl_linux.go#L270-L306","documentation":"cleanChains could not run ChainExists(\"mangle\", \"PREROUTING\"). PREROUTING is a built-in chain present whenever the mangle table is loaded, so this error means the iptables invocation itself failed: the iptable_mangle module is not loaded, the process lacks privileges, the binary is missing, or the xtables lock is held. The mangle check guards removal of the NETBIRD-RT-PRE jump and mark rules installed by the router.","triggerScenarios":"Reset/cleanChains on kernels where mangle support is modular and unloaded (`modprobe iptable_mangle` fixes it); distroless images without iptables; non-root agents; hosts where another daemon holds the lock during cleanup.","commonSituations":"Minimal cloud/kernel images with iptable_mangle compiled as module and no auto-load triggered (the filter-table usage earlier does not load mangle); hardened containers; embedded devices with trimmed netfilter.","solutions":["Load the module: `modprobe iptable_mangle` (and ip6table_mangle for v6) or bake it into the kernel/image.","Confirm root/CAP_NET_ADMIN for the daemon.","Check `iptables -t mangle -L` succeeds manually in the same context.","Retry after clearing concurrent iptables users."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// mangle table must be usable before Reset\nout, err := exec.Command(\"iptables\", \"-t\", \"mangle\", \"-L\", \"-n\").CombinedOutput()\nif err != nil {\n    return fmt.Errorf(\"mangle table unavailable (modprobe iptable_mangle?): %s\", out)\n}","typeGuard":null,"tryCatchPattern":"if err := mgr.Reset(); err != nil {\n    if strings.Contains(err.Error(), \"list chains\") {\n        // table/binary/privilege issue on the mangle table: surface for module loading\n        log.Errorf(\"mangle chain listing failed: %v; run modprobe iptable_mangle\", err)\n    }\n}","preventionTips":["Load iptable_mangle (and ip6table_mangle for v6) at boot on modular kernels.","Include the full netfilter module set in minimal images used for the agent.","Verify `iptables -t mangle -L` works in the daemon's exact environment before deploying.","Run as root; chain listing under nft/legacy backends also requires consistent backend selection."],"tags":["go","linux","iptables","mangle","kernel-modules","firewall","netbird"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}