{"record":{"id":"2d1a16172e2e3d54","repo":"netbirdio/netbird","slug":"create-chain-s-in-table-s-w","errorCode":null,"errorMessage":"create chain %s in table %s: %w","messagePattern":"create chain (.+?) in table (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/firewall/iptables/router_linux.go","lineNumber":458,"sourceCode":"\tfor _, chainInfo := range []struct {\n\t\tchain string\n\t\ttable string\n\t}{\n\t\t{chainRTFWDIN, tableFilter},\n\t\t{chainRTFWDOUT, tableFilter},\n\t\t{chainRTPRE, tableMangle},\n\t\t{chainRTNAT, tableNat},\n\t\t{chainRTRDR, tableNat},\n\t\t{chainRTMSSCLAMP, tableMangle},\n\t} {\n\t\t// Fallback: clear chains that survived an unclean shutdown.\n\t\tif ok, _ := r.iptablesClient.ChainExists(chainInfo.table, chainInfo.chain); ok {\n\t\t\tif err := r.iptablesClient.ClearAndDeleteChain(chainInfo.table, chainInfo.chain); err != nil {\n\t\t\t\tlog.Warnf(\"clear stale chain %s in %s: %v\", chainInfo.chain, chainInfo.table, err)\n\t\t\t}\n\t\t}\n\t\tif err := r.iptablesClient.NewChain(chainInfo.table, chainInfo.chain); err != nil {\n\t\t\treturn fmt.Errorf(\"create chain %s in table %s: %w\", chainInfo.chain, chainInfo.table, err)\n\t\t}\n\t}\n\n\tif err := r.insertEstablishedRule(chainRTFWDIN); err != nil {\n\t\treturn fmt.Errorf(\"insert established rule: %w\", err)\n\t}\n\n\tif err := r.insertEstablishedRule(chainRTFWDOUT); err != nil {\n\t\treturn fmt.Errorf(\"insert established rule: %w\", err)\n\t}\n\n\tif err := r.addPostroutingRules(); err != nil {\n\t\treturn fmt.Errorf(\"add static nat rules: %w\", err)\n\t}\n\n\tif err := r.addJumpRules(); err != nil {\n\t\treturn fmt.Errorf(\"add jump rules: %w\", err)\n\t}","sourceCodeStart":440,"sourceCodeEnd":476,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/firewall/iptables/router_linux.go#L440-L476","documentation":"Returned by router.createContainers when insertEstablishedRule(NETBIRD-RT-FWD-IN) fails. insertEstablishedRule Inserts '-m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT' at position 1 of the just-created filter chain so existing flows bypass route ACL evaluation. Failure means the iptables Insert rejected the spec.","triggerScenarios":"During init/createContainers right after NewChain succeeded on NETBIRD-RT-FWD-IN. Fails when xt_conntrack module/kernel CONFIG is missing ('No such file or directory'), the chain disappeared between create and insert, or the xtables lock is contended.","commonSituations":"Minimal/embedded kernels and slim containers without conntrack support; hosts where another agent instance deleted chains mid-init; conntrack table exhaustion is a different error but worth checking under load.","solutions":["Load the module: modprobe xt_conntrack (check CONFIG_NETFILTER_XT_MATCH_CONNTRACK)","Test manually: sudo iptables -I NETBIRD-RT-FWD-IN 1 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT","Check for concurrent netbird instances deleting chains during init","Retry agent start once the module is loaded"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"# preflight conntrack match support\nsudo iptables -C FORWARD -m conntrack --ctstate ESTABLISHED -j ACCEPT 2>&1 || modprobe xt_conntrack","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Load xt_conntrack before starting the agent on minimal kernels","Verify CONFIG_NETFILTER_XT_MATCH_CONNTRACK in custom kernels","Re-run agent init after loading modules; the insert is recreated"],"tags":["iptables","conntrack","initialization","linux","netbird"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}