{"record":{"id":"3353d86b9ed52d19","repo":"netbirdio/netbird","slug":"init-iptables-w","errorCode":null,"errorMessage":"init iptables: %w","messagePattern":"init iptables: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/firewall/iptables/manager_linux.go","lineNumber":52,"sourceCode":"\trawSupported bool\n\n\t// IPv6 counterparts, nil when no v6 overlay\n\tipv6Client *iptables.IPTables\n\taclMgr6    *aclManager\n\trouter6    *router\n}\n\n// iFaceMapper defines subset methods of interface required for manager\ntype iFaceMapper interface {\n\tName() string\n\tAddress() wgaddr.Address\n}\n\n// Create iptables firewall manager\nfunc Create(wgIface iFaceMapper, mtu uint16) (*Manager, error) {\n\tiptablesClient, err := iptables.NewWithProtocol(iptables.ProtocolIPv4)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"init iptables: %w\", err)\n\t}\n\n\tm := &Manager{\n\t\twgIface:    wgIface,\n\t\tipv4Client: iptablesClient,\n\t}\n\n\tm.router, err = newRouter(iptablesClient, wgIface, mtu)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"create router: %w\", err)\n\t}\n\n\tm.aclMgr, err = newAclManager(iptablesClient, wgIface)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"create acl manager: %w\", err)\n\t}\n\n\tif wgIface.Address().HasIPv6() {","sourceCodeStart":34,"sourceCodeEnd":70,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/firewall/iptables/manager_linux.go#L34-L70","documentation":"Manager creation failed at iptables.NewWithProtocol(ProtocolIPv4): go-iptables locates an iptables binary (iptables or iptables-nft depending on version), runs `iptables --version`, and parses the version; failure means no usable binary in PATH, an unreadable/old binary (below the supported version), or an exec error. This aborts iptables firewall manager construction entirely, so the agent either falls back to another firewall backend or fails to start.","triggerScenarios":"Running the agent in a minimal/distroless container without iptables installed; systemd/service environments whose PATH omits /usr/sbin where iptables lives; an iptables wrapper or broken symlink first in PATH; an extremely old iptables (<1.4.11).","commonSituations":"Scratch/distroless Docker images; macOS/Windows dev builds of Linux binaries tested in odd sandboxes; PATH stripped by su/sudo -E invocations; nft-only hosts where iptables-nft is absent but legacy iptables was removed.","solutions":["Install iptables in the target image/host (e.g. `apt-get install -y iptables` or `apk add iptables iptables-nft`).","Ensure the service unit PATH includes /usr/sbin and /sbin, or use an absolute path via go-iptables' binary selection if wrapped.","Verify manually: `iptables --version` as the same user/env the daemon uses.","If the host is nft-only, prefer the nftables firewall manager instead of installing legacy iptables."],"exampleFix":"# before: container image with no iptables\nFROM scratch ...\n\n# after\nRUN apk add --no-cache iptables ip6tables ipset\n# or for debian-based images:\nRUN apt-get update && apt-get install -y iptables ipset","handlingStrategy":"validation","validationCode":"func verifyIptablesBinaries() error {\n    bins := []string{\"iptables\"}\n    for _, b := range bins {\n        p, err := exec.LookPath(b)\n        if err != nil {\n            return fmt.Errorf(\"%s not found in PATH %q: %w\", b, os.Getenv(\"PATH\"), err)\n        }\n        out, err := exec.Command(p, \"--version\").Output()\n        if err != nil {\n            return fmt.Errorf(\"%s --version failed: %w\", p, err)\n        }\n        _ = out // presence and executability are what matter pre-flight\n    }\n    return nil\n}\n\n// call before iptables.Create(...)","typeGuard":null,"tryCatchPattern":"if _, err := iptablesMgr.Create(wgIface, mtu); err != nil {\n    if strings.Contains(err.Error(), \"init iptables\") {\n        // environment defect: no usable binary; install iptables or use the nftables manager\n        log.Fatalf(\"iptables unavailable: %v; install iptables or switch firewall backend\", err)\n    }\n}","preventionTips":["Include iptables (and ipset) in every container image that runs the agent.","Set PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin in systemd units.","Smoke-test `iptables --version` as the daemon user in CI for your deployment image.","On nft-only hosts, select the nftables firewall manager explicitly instead of relying on iptables compatibility."],"tags":["go","linux","iptables","environment","startup","container","netbird"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}