{"record":{"id":"4413a85fe154306a","repo":"cilium/cilium","slug":"inserting-ipv4-from-ingress-proxy-routing-rule-v","errorCode":null,"errorMessage":"inserting ipv4 from ingress proxy routing rule %v: %w","messagePattern":"inserting ipv4 from ingress proxy routing rule (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/proxy/routes.go","lineNumber":280,"sourceCode":"\t\tAdminDistance: reconciler.AdminDistanceDefault,\n\n\t\tDevice: device,\n\t\tScope:  reconciler.Scope(netlink.SCOPE_LINK),\n\t}\n\tfromProxyDefaultRoute4 := reconciler.DesiredRoute{\n\t\tOwner:         routeOwner,\n\t\tTable:         linux_defaults.RouteTableFromProxy,\n\t\tPrefix:        netip.MustParsePrefix(\"0.0.0.0/0\"),\n\t\tAdminDistance: reconciler.AdminDistanceDefault,\n\n\t\tNexthop: ipv4,\n\t\tDevice:  device,\n\t\tMTU:     uint32(mtu),\n\t}\n\n\tif fromIngressProxy {\n\t\tif err := route.ReplaceRule(fromIngressProxyRule); err != nil {\n\t\t\treturn fmt.Errorf(\"inserting ipv4 from ingress proxy routing rule %v: %w\", fromIngressProxyRule, err)\n\t\t}\n\t}\n\tif fromEgressProxy {\n\t\tif err := route.ReplaceRule(fromEgressProxyRule); err != nil {\n\t\t\treturn fmt.Errorf(\"inserting ipv4 from egress proxy routing rule %v: %w\", fromEgressProxyRule, err)\n\t\t}\n\t}\n\tif err := routeManager.UpsertRouteWait(fromProxyToCiliumHostRoute4); err != nil {\n\t\treturn fmt.Errorf(\"inserting ipv4 from proxy to cilium_host route %v: %w\", fromProxyToCiliumHostRoute4, err)\n\t}\n\tif err := routeManager.UpsertRouteWait(fromProxyDefaultRoute4); err != nil {\n\t\treturn fmt.Errorf(\"inserting ipv4 from proxy default route %v: %w\", fromProxyDefaultRoute4, err)\n\t}\n\n\treturn nil\n}\n\n// removeFromProxyRulesIPv4 ensures routes and rules for traffic from the proxy are removed.","sourceCodeStart":262,"sourceCodeEnd":298,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/proxy/routes.go#L262-L298","documentation":"Installing the IPv4 'from ingress proxy' netlink routing rule failed. installFromProxyRoutesIPv4 calls route.ReplaceRule(fromIngressProxyRule) to create/replace the rule that sends traffic from the ingress proxy into the routing table for Cilium; a non-nil netlink error is wrapped and returned. Raised only when the fromIngressProxy flag is enabled.","triggerScenarios":"ReinstallRoutingRules -> installFromProxyRoutesIPv4 with fromIngressProxy=true and route.ReplaceRule(fromIngressProxyRule) returning an error (rule priority conflicts, table mismatch, permission failure).","commonSituations":"Hosts where another CNI or routing daemon already owns rule priorities; agents lacking CAP_NET_ADMIN; iprule tables exhausted or corrupted after repeated restarts.","solutions":["Inspect 'ip rule show' for conflicting rules at the same priority as fromIngressProxyRule","Ensure the agent has CAP_NET_ADMIN and can open netlink sockets in the host netns","Check for other network agents (kube-proxy modes, other CNIs) contending for ip rules","Restart the agent to re-run ReinstallRoutingRules once netlink state is clean"],"exampleFix":"// before\n# conflicting rule at same priority\n32765: from all fwmark 0xA00/0xF00 lookup 2005\n// after\n# remove conflicting rule, then reinstall\nip rule del priority 32765 fwmark 0xA00/0xF00 lookup 2005\ncilium-agent: restart to re-run ReinstallRoutingRules","handlingStrategy":"try-catch","validationCode":"// preflight\nout, _ := exec.Command(\"ip\", \"rule\", \"show\").Output()\nif strings.Contains(string(out), fmt.Sprintf(\"%d:\", fromIngressProxyRule.Priority)) {\n  return errors.New(\"conflicting ip rule priority already installed\")\n}","typeGuard":null,"tryCatchPattern":"if err := ReinstallRoutingRules(...); err != nil {\n  var ctxErr *fmt.Errorf // wrapped with %w\n  if errors.Is(err, unix.EPERM) {\n    log.Error(\"cannot insert ipv4 ingress proxy rule: missing NET_ADMIN\")\n  }\n  return err\n}","preventionTips":["Ensure no other CNI/daemon claims the same ip rule priorities","Deploy the agent with NET_ADMIN capability and hostNetwork: true","Check rule state after upgrades where mark/priority definitions changed","Log 'ip rule show' at startup to detect drift early"],"tags":["netlink","ipv4","routing","cilium"],"backgroundTag":"netlink-route-operation-failed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}