{"record":{"id":"60647e8009a005b4","repo":"netbirdio/netbird","slug":"clean-jump-rules-w","errorCode":null,"errorMessage":"clean jump rules: %w","messagePattern":"clean jump rules: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"client/firewall/iptables/router_linux.go","lineNumber":398,"sourceCode":"\t}\n\n\tif err := r.ipsetCounter.Flush(); err != nil {\n\t\tmerr = multierror.Append(merr, err)\n\t}\n\n\tif err := r.cleanupDataPlaneMark(); err != nil {\n\t\tmerr = multierror.Append(merr, err)\n\t}\n\n\tr.rules = make(map[string][]string)\n\tr.updateState()\n\n\treturn nberrors.FormatErrorOrNil(merr)\n}\n\nfunc (r *router) cleanUpDefaultForwardRules() error {\n\tif err := r.cleanJumpRules(); err != nil {\n\t\treturn fmt.Errorf(\"clean jump rules: %w\", err)\n\t}\n\n\tlog.Debug(\"flushing routing related tables\")\n\n\t// Remove jump rules from built-in chains before deleting custom chains,\n\t// otherwise the chain deletion fails with \"device or resource busy\".\n\tif ok, err := r.iptablesClient.ChainExists(tableNat, chainNATOutput); err != nil {\n\t\treturn fmt.Errorf(\"check chain %s: %w\", chainNATOutput, err)\n\t} else if ok {\n\t\tjumpRule := []string{\"-j\", chainNATOutput}\n\t\tif err := r.iptablesClient.Delete(tableNat, \"OUTPUT\", jumpRule...); err != nil {\n\t\t\tlog.Debugf(\"clean OUTPUT jump rule: %v\", err)\n\t\t}\n\t}\n\n\tfor _, chainInfo := range []struct {\n\t\tchain string\n\t\ttable string","sourceCodeStart":380,"sourceCodeEnd":416,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/firewall/iptables/router_linux.go#L380-L416","documentation":"Returned by router.cleanUpDefaultForwardRules when cleanJumpRules fails. cleanJumpRules deletes the jump rules the router installed from built-in chains (POSTROUTING/PREROUTING nat, FORWARD mangle for MSS clamp) using specs stored under well-known keys in r.rules, returning early on the first DeleteIfExists failure or an unknown key. init() only logs this error; Reset() propagates it inside a multierror.","triggerScenarios":"Agent startup (init) or Reset()/teardown, for jump-rule keys present in r.rules (restored from persisted state or created this session). Fails on iptables invocation errors: xtables lock contention, backend switch, or the built-in chain having been replaced by another tool.","commonSituations":"firewalld/ufw restarts replacing base chains while netbird tears down; crash-recovery where persisted r.rules reference specs that no longer parse under the active iptables backend.","solutions":["Retry: init proceeds to recreate containers anyway, and next run repeats the cleanup","Manually verify built-in chains: sudo iptables -t nat -S POSTROUTING; -t mangle -S PREROUTING; -t mangle -S FORWARD","Remove stale NETBIRD jump rules by hand if the sweep keeps failing","Avoid restarting other firewall services exactly while netbird starts/stops"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := r.cleanUpDefaultForwardRules(); err != nil {\n\tlog.Errorf(\"failed to clean up rules from FORWARD chain: %s\", err) // init already tolerates this\n}","preventionTips":["Keep other firewall services from rewriting base chains during agent start/stop","Re-run agent start so cleanup retries","Persist jump-rule specs so recovery sessions can still find them"],"tags":["iptables","cleanup","linux","netbird"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}