{"record":{"id":"31eeda730fce6ee2","repo":"netbirdio/netbird","slug":"block-wg-v4-net-w","errorCode":null,"errorMessage":"block wg v4 net: %w","messagePattern":"block wg v4 net: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/firewall/uspfilter/filter.go","lineNumber":372,"sourceCode":"\n\tsources := []netip.Prefix{netip.PrefixFrom(netip.IPv4Unspecified(), 0)}\n\tv6Net := iface.Address().IPv6Net\n\tif v6Net.IsValid() {\n\t\tsources = append(sources, netip.PrefixFrom(netip.IPv6Unspecified(), 0))\n\t}\n\n\tvar rules []firewall.Rule\n\tv4Rule, err := m.addRouteFiltering(\n\t\tnil,\n\t\tsources,\n\t\tfirewall.Network{Prefix: wgPrefix},\n\t\tfirewall.ProtocolALL,\n\t\tnil,\n\t\tnil,\n\t\tfirewall.ActionDrop,\n\t)\n\tif err != nil {\n\t\treturn rules, fmt.Errorf(\"block wg v4 net: %w\", err)\n\t}\n\trules = append(rules, v4Rule)\n\n\tif v6Net.IsValid() {\n\t\tlog.Debugf(\"blocking invalid routed traffic for %s\", v6Net)\n\t\tv6Rule, err := m.addRouteFiltering(\n\t\t\tnil,\n\t\t\tsources,\n\t\t\tfirewall.Network{Prefix: v6Net},\n\t\t\tfirewall.ProtocolALL,\n\t\t\tnil,\n\t\t\tnil,\n\t\t\tfirewall.ActionDrop,\n\t\t)\n\t\tif err != nil {\n\t\t\treturn rules, fmt.Errorf(\"block wg v6 net: %w\", err)\n\t\t}\n\t\trules = append(rules, v6Rule)","sourceCodeStart":354,"sourceCodeEnd":390,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/firewall/uspfilter/filter.go#L354-L390","documentation":"Returned by blockInvalidRouted (client/firewall/uspfilter/filter.go:372) when installing the userspace drop rule for the IPv4 overlay prefix fails: m.addRouteFiltering(nil, sources, Network{Prefix: wgPrefix}, ProtocolALL, nil, nil, ActionDrop) rejects its inputs or fails registering the rule. This is an in-memory uspfilter rule (no kernel netlink), so failures are input-validation class: an invalid wgPrefix taken from iface.Address().Network (unset address yields an invalid netip.Prefix), or an invalid source network in the sources list.","triggerScenarios":"EnableRouting called before the interface address was assigned, so wgPrefix (iface.Address().Network) is not a valid prefix; sources containing an invalid/expired network object; manager state reset concurrently with EnableRouting.","commonSituations":"Race between engine bring-up and routing enable on slow address configuration; netstack mode where Address() is populated late; management network-map updates replacing sources mid-install.","solutions":["Verify iface.Address().Network.IsValid() (and Bits() within 0..32) before calling EnableRouting/blockInvalidRouted","Re-run EnableRouting after the interface address is configured; EnableRouting is idempotent under the manager mutex","Log the wgPrefix value in the error path so an invalid prefix is immediately visible","If sources are dynamic, snapshot them under lock before building rules"],"exampleFix":"// before\nv4Rule, err := m.addRouteFiltering(nil, sources, firewall.Network{Prefix: wgPrefix}, firewall.ProtocolALL, nil, nil, firewall.ActionDrop)\nif err != nil {\n    return rules, fmt.Errorf(\"block wg v4 net: %w\", err)\n}\n// after\nif !wgPrefix.IsValid() || wgPrefix.Bits() < 0 || wgPrefix.Bits() > 32 {\n    return rules, fmt.Errorf(\"block wg v4 net: invalid overlay prefix %s\", wgPrefix)\n}\nv4Rule, err := m.addRouteFiltering(nil, sources, firewall.Network{Prefix: wgPrefix}, firewall.ProtocolALL, nil, nil, firewall.ActionDrop)\nif err != nil {\n    return rules, fmt.Errorf(\"block wg v4 net: %w\", err)\n}","handlingStrategy":"validation","validationCode":"addr := iface.Address()\nif !addr.Network.IsValid() || addr.Network.Bits() < 0 || addr.Network.Bits() > 32 {\n    return fmt.Errorf(\"cannot enable routing: overlay prefix %s invalid\", addr.Network)\n}\nif err := fw.EnableRouting(); err != nil { ... }","typeGuard":"func validOverlayV4Prefix(p netip.Prefix) bool {\n    return p.IsValid() && p.Addr().Is4() && p.Bits() >= 0 && p.Bits() <= 32\n}","tryCatchPattern":"if err := fw.EnableRouting(); err != nil {\n    if strings.Contains(err.Error(), \"block wg v4 net\") {\n        // no protection installed; fail closed for routed traffic\n        return fmt.Errorf(\"routing blocked until overlay prefix is valid: %w\", err)\n    }\n    return err\n}","preventionTips":["Enable routing only after the interface address is assigned","Mask overlay prefixes at the boundary where management config is parsed","Fail closed when the default-drop protection cannot be installed - routed traffic without it bypasses policy"],"tags":["uspfilter","routing","firewall","validation"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}