{"record":{"id":"4a09fe36da8c64ac","repo":"netbirdio/netbird","slug":"add-legacy-routing-rule-w","errorCode":null,"errorMessage":"add legacy routing rule: %w","messagePattern":"add legacy routing rule: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/firewall/iptables/router_linux.go","lineNumber":270,"sourceCode":"\n\treturn nil\n}\n\nfunc (r *router) deleteIpSet(setName string) error {\n\tif err := r.destroyIPSet(setName); err != nil {\n\t\treturn fmt.Errorf(\"destroy set %s: %w\", setName, err)\n\t}\n\n\tlog.Debugf(\"Deleted unused ipset %s\", setName)\n\treturn nil\n}\n\n// AddNatRule inserts an iptables rule pair into the nat chain\nfunc (r *router) AddNatRule(pair firewall.RouterPair) error {\n\tif r.legacyManagement {\n\t\tlog.Warnf(\"This peer is connected to a NetBird Management service with an older version. Allowing all traffic for %s\", pair.Destination)\n\t\tif err := r.addLegacyRouteRule(pair); err != nil {\n\t\t\treturn fmt.Errorf(\"add legacy routing rule: %w\", err)\n\t\t}\n\t}\n\n\tif !pair.Masquerade {\n\t\treturn nil\n\t}\n\n\tif err := r.addNatRule(pair); err != nil {\n\t\treturn fmt.Errorf(\"add nat rule: %w\", err)\n\t}\n\n\tif err := r.addNatRule(firewall.GetInversePair(pair)); err != nil {\n\t\treturn fmt.Errorf(\"add inverse nat rule: %w\", err)\n\t}\n\n\tr.updateState()\n\n\treturn nil","sourceCodeStart":252,"sourceCodeEnd":288,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/firewall/iptables/router_linux.go#L252-L288","documentation":"Returned by router.AddNatRule when the peer is connected to a pre-route-ACL Management (legacyManagement) and addLegacyRouteRule fails. That path removes any prior rule then appends '-s <src> -d <dst> -j ACCEPT' to NETBIRD-RT-FWD-IN so old management networks keep working. The wrap fires when that append path errors (see error 549 for the inner failure).","triggerScenarios":"AddNatRule(pair) with r.legacyManagement set via SetLegacyManagement after the login/legacy check. Fails when the NETBIRD-RT-FWD-IN chain does not exist because init/createContainers failed earlier, the iptables backend errors (binary missing, xtables lock held), or privileges were dropped.","commonSituations":"Peer managed by an old NetBird management (< route ACL era) on a host where the custom chains were flushed manually or by a crashed prior run; hosts with mixed iptables-legacy/nft backends; SELinux/AppArmor denying iptables execution.","solutions":["Check the agent log for the preceding 'create containers' failure and fix that first","Confirm the chain exists: sudo iptables -S NETBIRD-RT-FWD-IN (or -L)","Verify no other process holds the xtables lock (/run/xtables.lock)","Restart the agent (netbird down/up) so init recreates chains before rules are added"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// ensure the chain exists before the legacy append\nif ok, err := iptablesClient.ChainExists(tableFilter, chainRTFWDIN); err != nil {\n\treturn fmt.Errorf(\"check chain: %w\", err)\n} else if !ok {\n\treturn fmt.Errorf(\"chain %s missing; re-run init\", chainRTFWDIN)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Treat init/createContainers failures as fatal before applying rules","Upgrade management past the route-ACL era so legacy mode is never entered","Do not flush NETBIRD chains manually while connected to old management"],"tags":["iptables","legacy","compatibility","linux","netbird"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}