{"record":{"id":"57c99600cb5ef31d","repo":"netbirdio/netbird","slug":"block-invalid-routed-w","errorCode":null,"errorMessage":"block invalid routed: %w","messagePattern":"block invalid routed: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/firewall/uspfilter/filter.go","lineNumber":1772,"sourceCode":"\nfunc (m *Manager) EnableRouting() error {\n\tm.mutex.Lock()\n\tdefer m.mutex.Unlock()\n\n\tif err := m.determineRouting(); err != nil {\n\t\treturn fmt.Errorf(\"determine routing: %w\", err)\n\t}\n\n\tif m.forwarder.Load() == nil {\n\t\treturn nil\n\t}\n\n\trules, err := m.blockInvalidRouted(m.wgIface)\n\t// Persist whatever was installed even on partial failure, so DisableRouting\n\t// can clean it up later.\n\tm.blockRules = rules\n\tif err != nil {\n\t\treturn fmt.Errorf(\"block invalid routed: %w\", err)\n\t}\n\n\treturn nil\n}\n\nfunc (m *Manager) DisableRouting() error {\n\tm.mutex.Lock()\n\tdefer m.mutex.Unlock()\n\n\tfwder := m.forwarder.Load()\n\tif fwder == nil {\n\t\treturn nil\n\t}\n\n\tm.routingEnabled.Store(false)\n\tm.nativeRouter.Store(false)\n\n\tvar merr *multierror.Error","sourceCodeStart":1754,"sourceCodeEnd":1790,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/firewall/uspfilter/filter.go#L1754-L1790","documentation":"Returned by Manager.EnableRouting (client/firewall/uspfilter/filter.go:1772) wrapping blockInvalidRouted, which installs the default-drop protection against routed traffic entering the overlay. It composes errors 752/753: invalid v4 overlay prefix, or the v6 leg failing after v4 succeeded. Crucially EnableRouting persists the partial rules slice into m.blockRules before returning the error, so the protection that did install is tracked and DisableRouting can remove it.","triggerScenarios":"EnableRouting with an unset interface address (invalid wgPrefix); v6 leg failing with a malformed IPv6 prefix; addRouteFiltering rejecting source networks from the current network map.","commonSituations":"Routing enabled during engine bring-up races before address assignment; management pushing malformed IPv6 overlay config; partially initialized manager reused after Reset.","solutions":["Ensure the interface address (v4 required, v6 optional) is configured and valid before EnableRouting","Retry EnableRouting after bring-up completes; it is mutex-guarded and re-derives rules","Always pair a failed EnableRouting with DisableRouting (or manager Reset) so the persisted partial blockRules are cleaned","Fix the underlying v4/v6 prefix validation issue per errors 752/753"],"exampleFix":"// before\nif err != nil {\n    return fmt.Errorf(\"block invalid routed: %w\", err)\n}\n// after - keep partial rules tracked, report which family failed\nif err != nil {\n    _ = m.DisableRouting()\n    return fmt.Errorf(\"block invalid routed (installed %d of 2 rules): %w\", len(rules), err)\n}","handlingStrategy":"try-catch","validationCode":"if !iface.Address().Network.IsValid() {\n    return fmt.Errorf(\"routing prerequisites unmet: overlay prefix missing\")\n}\n_ = fw.EnableRouting()","typeGuard":null,"tryCatchPattern":"if err := fw.EnableRouting(); err != nil {\n    if strings.Contains(err.Error(), \"block invalid routed\") {\n        // partial rules were persisted; undo to avoid orphaned drop rules\n        if derr := fw.DisableRouting(); derr != nil {\n            log.Warnf(\"cleanup after failed enable: %v\", derr)\n        }\n        return fmt.Errorf(\"routing enable failed, protection rolled back: %w\", err)\n    }\n    return err\n}","preventionTips":["Always follow a failed EnableRouting with DisableRouting to clean persisted partial blockRules","Validate both overlay prefixes (v4 and optional v6) before enabling","Keep the partial-rules contract in blockInvalidRouted intact when refactoring - callers rely on it for cleanup"],"tags":["uspfilter","routing","firewall","partial-state"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}