{"record":{"id":"3d76d8bff77a9c0e","repo":"netbirdio/netbird","slug":"cleanup-notrack-chain-w","errorCode":null,"errorMessage":"cleanup notrack chain: %w","messagePattern":"cleanup notrack chain: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"client/firewall/iptables/manager_linux.go","lineNumber":340,"sourceCode":"func (m *Manager) SetLegacyManagement(isLegacy bool) error {\n\tif err := firewall.SetLegacyManagement(m.router, isLegacy); err != nil {\n\t\treturn err\n\t}\n\tif m.hasIPv6() {\n\t\treturn firewall.SetLegacyManagement(m.router6, isLegacy)\n\t}\n\treturn nil\n}\n\n// Reset firewall to the default state\nfunc (m *Manager) Close(stateManager *statemanager.Manager) error {\n\tm.mutex.Lock()\n\tdefer m.mutex.Unlock()\n\n\tvar merr *multierror.Error\n\n\tif err := m.cleanupNoTrackChain(); err != nil {\n\t\tmerr = multierror.Append(merr, fmt.Errorf(\"cleanup notrack chain: %w\", err))\n\t}\n\n\tif m.hasIPv6() {\n\t\tif err := m.aclMgr6.Reset(); err != nil {\n\t\t\tmerr = multierror.Append(merr, fmt.Errorf(\"reset v6 acl manager: %w\", err))\n\t\t}\n\t\tif err := m.router6.Reset(); err != nil {\n\t\t\tmerr = multierror.Append(merr, fmt.Errorf(\"reset v6 router: %w\", err))\n\t\t}\n\t}\n\n\tif err := m.aclMgr.Reset(); err != nil {\n\t\tmerr = multierror.Append(merr, fmt.Errorf(\"reset acl manager: %w\", err))\n\t}\n\tif err := m.router.Reset(); err != nil {\n\t\tmerr = multierror.Append(merr, fmt.Errorf(\"reset router: %w\", err))\n\t}\n","sourceCodeStart":322,"sourceCodeEnd":358,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/firewall/iptables/manager_linux.go#L322-L358","documentation":"First step of Manager.Close: cleanupNoTrackChain removes the NETBIRD-RAW chain and its OUTPUT/PREROUTING jump rules from the raw table (installed by SetupEBPFProxyNoTrack for the eBPF proxy). It fails when the raw-table iptables operations error while rawSupported is true. Like every Close error it is accumulated and intentionally blocks DeleteState, so the ShutdownState file stays persisted and the next startup's Cleanup() retries the removal.","triggerScenarios":"Manager.Close running when iptables raw-table calls fail: rule already deleted by an external flush (DeleteIfExists on vanished chains can still error at the ChainExists/ClearAndDeleteChain stage), permissions lost, or netns teardown races.","commonSituations":"Container runtime rewriting the raw table concurrently; agent stop during host network reconfiguration; a crash-recovery cleanup on next start encountering partially removed chains.","solutions":["Restart and stop the agent again: the persisted ShutdownState makes the next startup re-run Cleanup idempotently","Check for leftovers as root: iptables -t raw -S | grep NETBIRD-RAW and delete the chain plus jump rules manually if stuck","Capture the wrapped iptables error from the daemon log if it repeats"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := mgr.Close(stateManager); err != nil {\n    log.Warnf(\"firewall close incomplete, next start will retry via persisted state: %v\", err)\n    // no need to fail shutdown; ShutdownState.Cleanup is idempotent\n}","preventionTips":["Trust the persisted ShutdownState: an incomplete Close is retried on next start","Keep the agent's state directory writable so the state file survives for recovery","After force-kills, start/stop the agent once to let recovery finish raw-table cleanup"],"tags":["iptables","firewall","cleanup","raw-table","ebpf-proxy","netbird","go"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}