{"record":{"id":"53834cc8b39ddece","repo":"netbirdio/netbird","slug":"create-router-w","errorCode":null,"errorMessage":"create router: %w","messagePattern":"create router: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/firewall/iptables/manager_linux.go","lineNumber":62,"sourceCode":"\tName() string\n\tAddress() wgaddr.Address\n}\n\n// Create iptables firewall manager\nfunc Create(wgIface iFaceMapper, mtu uint16) (*Manager, error) {\n\tiptablesClient, err := iptables.NewWithProtocol(iptables.ProtocolIPv4)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"init iptables: %w\", err)\n\t}\n\n\tm := &Manager{\n\t\twgIface:    wgIface,\n\t\tipv4Client: iptablesClient,\n\t}\n\n\tm.router, err = newRouter(iptablesClient, wgIface, mtu)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"create router: %w\", err)\n\t}\n\n\tm.aclMgr, err = newAclManager(iptablesClient, wgIface)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"create acl manager: %w\", err)\n\t}\n\n\tif wgIface.Address().HasIPv6() {\n\t\tif err := m.createIPv6Components(wgIface, mtu); err != nil {\n\t\t\treturn nil, fmt.Errorf(\"create IPv6 firewall: %w\", err)\n\t\t}\n\t}\n\n\treturn m, nil\n}\n\nfunc (m *Manager) createIPv6Components(wgIface iFaceMapper, mtu uint16) error {\n\tip6Client, err := iptables.NewWithProtocol(iptables.ProtocolIPv6)","sourceCodeStart":44,"sourceCodeEnd":80,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/firewall/iptables/manager_linux.go#L44-L80","documentation":"Wraps newRouter's error during Manager creation. In the current source newRouter only allocates the router struct and a refcounter whose constructor cannot fail, returning nil error, so this wrap is effectively unreachable; it exists to future-proof constructor work. If it ever fires, it would indicate the v4 router's setup failed before init, i.e. an internal invariant break rather than an environment issue.","triggerScenarios":"Not reachable with the present implementation (newRouter returns r, nil). Hypothetically, adding fallible work to newRouter (chain checks, ipset probing) would surface here on iptables/privilege failures.","commonSituations":"Seeing this error in logs implies either a modified/forked newRouter or a stale binary; treat it as a version skew between the compiled manager_linux.go and router_linux.go.","solutions":["If hit on a fork, look at newRouter's added fallible steps (iptables exec, ipset create) and fix the underlying privilege/module issue.","On stock builds, capture logs and verify binary/source version alignment; the error indicates code drift.","Ensure the standard prerequisites anyway: root and a working iptables binary."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// nothing to validate for stock newRouter (infallible); for forks, pre-check its fallible steps\nif _, err := exec.LookPath(\"iptables\"); err != nil {\n    return fmt.Errorf(\"router construction will fail: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"if _, err := iptablesMgr.Create(wgIface, mtu); err != nil {\n    if strings.Contains(err.Error(), \"create router\") {\n        // stock code cannot produce this: verify binary/source alignment\n        log.Errorf(\"unexpected router construction failure; rebuild from matching sources: %v\", err)\n    }\n}","preventionTips":["Build the agent from a single consistent source tree so manager and router files cannot skew.","Treat 'create router' in logs as a signal of a modified build; capture version info for triage.","Keep constructors infallible in your forks; do fallible work in init() with real error context."],"tags":["go","linux","iptables","firewall","startup","netbird"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}