{"record":{"id":"4f568c2761b46fbd","repo":"netbirdio/netbird","slug":"s-init-w","errorCode":null,"errorMessage":"%s init: %w","messagePattern":"(.+?) init: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/firewall/iptables/manager_linux.go","lineNumber":172,"sourceCode":"\t\t{\"router\", m.router.init, m.router},\n\t\t{\"acl manager\", m.aclMgr.init, m.aclMgr},\n\t}\n\tif m.hasIPv6() {\n\t\tsteps = append(steps,\n\t\t\tinitStep{\"v6 router\", m.router6.init, m.router6},\n\t\t\tinitStep{\"v6 acl manager\", m.aclMgr6.init, m.aclMgr6},\n\t\t)\n\t}\n\n\tvar initialized []initStep\n\tfor _, s := range steps {\n\t\tif err := s.init(stateManager); err != nil {\n\t\t\tfor i := len(initialized) - 1; i >= 0; i-- {\n\t\t\t\tif rerr := initialized[i].mgr.Reset(); rerr != nil {\n\t\t\t\t\tlog.Warnf(\"rollback %s: %v\", initialized[i].name, rerr)\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn fmt.Errorf(\"%s init: %w\", s.name, err)\n\t\t}\n\t\tinitialized = append(initialized, s)\n\t}\n\treturn nil\n}\n\n// AddPeerFiltering adds a rule to the firewall\n//\n// Comment will be ignored because some system this feature is not supported\nfunc (m *Manager) AddPeerFiltering(\n\tid []byte,\n\tip net.IP,\n\tproto firewall.Protocol,\n\tsPort *firewall.Port,\n\tdPort *firewall.Port,\n\taction firewall.Action,\n\tipsetName string,\n) ([]firewall.Rule, error) {","sourceCodeStart":154,"sourceCodeEnd":190,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/firewall/iptables/manager_linux.go#L154-L190","documentation":"Init-time failure of one of the four subsystems (router, acl manager, v6 router, v6 acl manager) inside Manager.Init via initChains. The message prefixes the failing step name ('router init:', 'acl manager init:', 'v6 router init:', 'v6 acl manager init:') to the underlying cause, which is almost always an iptables operation failing in cleanChains, createDefaultChains, or createContainers. The library has already rolled back every previously initialized step in reverse order (Reset, failures logged as 'rollback ...'), so no half-built chains from this run survive.","triggerScenarios":"Calling Manager.Init(stateManager) when: the iptables/ip6tables binary is missing or not executable; the process lacks root/CAP_NET_ADMIN; List/Append on the filter or nat table errors; or the v6 steps run on a host without usable ip6tables even though the interface address has v6.","commonSituations":"Minimal or distroless containers without the iptables package; running the agent unprivileged; nftables-only hosts where the iptables-nft compatibility layer is absent; sandboxes without /proc/net; the v6 half failing because ip6tables lives in a separate distro package (e.g. iptables vs iptables-ipv6 splits).","solutions":["Run the daemon as root (the agent is a privileged daemon by design)","Install iptables and ip6tables and verify manually as root: iptables -L and ip6tables -L","On modern hosts prefer the nftables backend the factory normally selects via check() in client/firewall/create_linux.go","For userspace-bind setups, set NB_FORCE_USERSPACE_FIREWALL to skip the native firewall entirely","Check daemon logs for the preceding 'rollback' warnings to confirm cleanup ran"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"func canInitIptables() error {\n    if os.Geteuid() != 0 {\n        return fmt.Errorf(\"agent must run as root to program iptables\")\n    }\n    for _, bin := range []string{\"iptables\", \"ip6tables\"} {\n        if _, err := exec.LookPath(bin); err != nil {\n            return fmt.Errorf(\"%s not installed\", bin)\n        }\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"if err := mgr.Init(stateManager); err != nil {\n    log.Errorf(\"firewall init failed (rollback already done by library): %v\", err)\n    // choose a fallback: nftables backend, userspace firewall, or abort\n    return fmt.Errorf(\"init firewall: %w\", err)\n}","preventionTips":["Pre-flight check root privileges and iptables/ip6tables presence before Init","In userspace-bind deployments set NB_FORCE_USERSPACE_FIREWALL to avoid native init entirely","Watch for 'rollback' log lines after any init failure to confirm no chains leaked"],"tags":["iptables","firewall","initialization","permissions","netbird","go"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}