{"record":{"id":"6c4eba4f0e6fe065","repo":"netbirdio/netbird","slug":"allow-netbird-v4-interface-traffic-w","errorCode":null,"errorMessage":"allow netbird v4 interface traffic: %w","messagePattern":"allow netbird v4 interface traffic: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/firewall/iptables/manager_linux.go","lineNumber":381,"sourceCode":"\t}\n\n\t// attempt to delete state only if all other operations succeeded\n\tif merr == nil {\n\t\tif err := stateManager.DeleteState(&ShutdownState{}); err != nil {\n\t\t\tmerr = multierror.Append(merr, fmt.Errorf(\"delete state: %w\", err))\n\t\t}\n\t}\n\n\treturn nberrors.FormatErrorOrNil(merr)\n}\n\n// AllowNetbird allows netbird interface traffic.\n// This is called when USPFilter wraps the native firewall, adding blanket accept\n// rules so that packet filtering is handled in userspace instead of by netfilter.\nfunc (m *Manager) AllowNetbird() error {\n\tvar merr *multierror.Error\n\tif _, err := m.AddPeerFiltering(nil, net.IP{0, 0, 0, 0}, firewall.ProtocolALL, nil, nil, firewall.ActionAccept, \"\"); err != nil {\n\t\tmerr = multierror.Append(merr, fmt.Errorf(\"allow netbird v4 interface traffic: %w\", err))\n\t}\n\tif m.hasIPv6() {\n\t\tif _, err := m.AddPeerFiltering(nil, net.IPv6zero, firewall.ProtocolALL, nil, nil, firewall.ActionAccept, \"\"); err != nil {\n\t\t\tmerr = multierror.Append(merr, fmt.Errorf(\"allow netbird v6 interface traffic: %w\", err))\n\t\t}\n\t}\n\n\tif err := firewalld.TrustInterface(m.wgIface.Name()); err != nil {\n\t\tlog.Warnf(\"failed to trust interface in firewalld: %v\", err)\n\t}\n\n\treturn nberrors.FormatErrorOrNil(merr)\n}\n\n// Flush doesn't need to be implemented for this manager\nfunc (m *Manager) Flush() error { return nil }\n\n// SetLogLevel sets the log level for the firewall manager","sourceCodeStart":363,"sourceCodeEnd":399,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/firewall/iptables/manager_linux.go#L363-L399","documentation":"AllowNetbird installs a blanket ACCEPT for all v4 overlay traffic (0.0.0.0, ProtocolALL) via AddPeerFiltering, so that packet filtering happens in userspace when USPFilter wraps the native firewall (called from client/firewall/create_linux.go:108). This error means the v4 accept rule could not be appended to NETBIRD-ACL-INPUT; the uspfilter wrapper logs it and continues, but the kernel chain may then drop overlay traffic that userspace expected to be pre-allowed.","triggerScenarios":"AllowNetbird when the v4 aclManager append fails - NETBIRD-ACL-INPUT missing after an external flush, iptables erroring, or a race with Close/reset.","commonSituations":"Userspace-bind agents (no kernel WireGuard) whose native chains were wiped by docker/podman/firewalld mid-run; chains removed between Init and AllowNetbird.","solutions":["Restart the agent: Init re-creates the ACL chains and AllowNetbird is retried during firewall creation","Verify the chain exists as root: iptables -S NETBIRD-ACL-INPUT","If it recurs, find the external tool rewriting the filter table and exclude the NETBIRD chains"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// before relying on userspace filtering, confirm the v4 accept chain exists\nif out, err := exec.Command(\"iptables\", \"-S\", \"NETBIRD-ACL-INPUT\").Output(); err != nil {\n    log.Warnf(\"ACL chain missing; AllowNetbird rule cannot hold: %s\", out)\n}","typeGuard":null,"tryCatchPattern":"if err := fm.AllowNetbird(); err != nil {\n    log.Errorf(\"userspace pre-allow failed; overlay traffic may be dropped by kernel chains: %v\", err)\n    // recreate chains via restart rather than proceeding degraded\n}","preventionTips":["Call AllowNetbird only right after successful Init so chains are fresh","Protect NETBIRD chains from external flush tools in container environments","Treat this error as connectivity-affecting, not cosmetic"],"tags":["iptables","firewall","userspace","acl","netbird","go"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}