{"record":{"id":"2e584c84bee4da35","repo":"slackhq/nebula","slug":"add-v6-filter-w","errorCode":null,"errorMessage":"add v6 filter: %w","messagePattern":"add v6 filter: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"wfp/wfp_windows.go","lineNumber":213,"sourceCode":"\tprocFwpmEngineClose0.Call(s.engine)\n\ts.engine = 0\n}\n\n// PermitInterface installs PERMIT filters at FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 and _V6 scoped to the given network\n// interface LUID. Inbound traffic on that interface bypasses Windows Defender Firewall.\nfunc PermitInterface(luid uint64) (*Session, error) {\n\ts, sublayerKey, err := newSession()\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tif err := addInterfaceFilter(s.engine, sublayerKey, fwpmLayerAleAuthRecvAcceptV4, luid); err != nil {\n\t\ts.Close()\n\t\treturn nil, fmt.Errorf(\"add v4 filter: %w\", err)\n\t}\n\tif err := addInterfaceFilter(s.engine, sublayerKey, fwpmLayerAleAuthRecvAcceptV6, luid); err != nil {\n\t\ts.Close()\n\t\treturn nil, fmt.Errorf(\"add v6 filter: %w\", err)\n\t}\n\treturn s, nil\n}\n\n// PermitUDPPort installs PERMIT filters at FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 and _V6 scoped to UDP traffic with the\n// given local port. Inbound UDP to that port on any interface bypasses Windows Defender Firewall.\nfunc PermitUDPPort(port uint16) (*Session, error) {\n\ts, sublayerKey, err := newSession()\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tif err := addUDPPortFilter(s.engine, sublayerKey, fwpmLayerAleAuthRecvAcceptV4, port); err != nil {\n\t\ts.Close()\n\t\treturn nil, fmt.Errorf(\"add v4 filter: %w\", err)\n\t}\n\tif err := addUDPPortFilter(s.engine, sublayerKey, fwpmLayerAleAuthRecvAcceptV6, port); err != nil {\n\t\ts.Close()","sourceCodeStart":195,"sourceCodeEnd":231,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/wfp/wfp_windows.go#L195-L231","documentation":"PermitInterface failed to install the IPv6 WFP permit filter at FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 for the given interface LUID, after the V4 filter succeeded. The session is closed to roll back, and the underlying addInterfaceFilter error is wrapped with %w.","triggerScenarios":"Calling wfp.PermitInterface when the V6 addInterfaceFilter fails - commonly because IPv6 is disabled on the host, the V6 layer/provider is unavailable, or FwpmFilterAdd0 returns FWPE_E_LAYER_NOT_FOUND / access denied.","commonSituations":"Hosts with IPv6 disabled via netsh or registry (WFP V6 layers still exist but conditions may fail); admin-less execution; security software blocking filter registration; partial success confusion when V4 succeeded but V6 fails.","solutions":["Inspect the wrapped FWPM error code for the exact cause.","If IPv6 is intentionally disabled on the host, treat a V6-layer failure as non-fatal or skip V6 filtering.","Run elevated and verify no third-party firewall provider is rejecting the filter add.","Re-enable IPv6 in Windows if the V6 WFP layers are needed."],"exampleFix":"// before\nif err := addInterfaceFilter(s.engine, sublayerKey, fwpmLayerAleAuthRecvAcceptV6, luid); err != nil {\n\ts.Close()\n\treturn nil, fmt.Errorf(\"add v6 filter: %w\", err)\n}\n// after\nif err := addInterfaceFilter(s.engine, sublayerKey, fwpmLayerAleAuthRecvAcceptV6, luid); err != nil {\n\ts.Close()\n\tif ipv6DisabledOnHost() { return permitV4Only() }\n\treturn nil, fmt.Errorf(\"add v6 filter: %w\", err)\n}","handlingStrategy":"fallback","validationCode":"// detect IPv6 availability before requesting V6 filters\nv6Enabled, _ := ipv6Supported()\nif !v6Enabled {\n\t// skip PermitInterface or accept v4-only bypass coverage\n}","typeGuard":"func isV6FilterErr(err error) bool { return err != nil && strings.Contains(err.Error(), \"add v6 filter\") }","tryCatchPattern":"session, err := wfp.PermitInterface(luid)\nif err != nil && isV6FilterErr(err) {\n\t// degrade: v4 filter succeeded but session was closed; retry with v4-only path if available\n\treturn err\n}","preventionTips":["Know the host's IPv6 state (netsh interface ipv6 show interfaces) before installing V6 filters.","Treat V6 filter failure distinctly from V4: check which layer failed in the message.","Run elevated and verify WFP provider conflicts.","Keep an operational fallback that does not require V6 bypass."],"tags":["windows","wfp","firewall","ipv6","network"],"backgroundTag":"firewall-filter-install-failed","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}