{"record":{"id":"89b07bf2f4aa2cf0","repo":"netbirdio/netbird","slug":"reset-router-w","errorCode":null,"errorMessage":"reset router: %w","messagePattern":"reset router: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"client/firewall/iptables/manager_linux.go","lineNumber":356,"sourceCode":"\n\tif err := m.cleanupNoTrackChain(); err != nil {\n\t\tmerr = multierror.Append(merr, fmt.Errorf(\"cleanup notrack chain: %w\", err))\n\t}\n\n\tif m.hasIPv6() {\n\t\tif err := m.aclMgr6.Reset(); err != nil {\n\t\t\tmerr = multierror.Append(merr, fmt.Errorf(\"reset v6 acl manager: %w\", err))\n\t\t}\n\t\tif err := m.router6.Reset(); err != nil {\n\t\t\tmerr = multierror.Append(merr, fmt.Errorf(\"reset v6 router: %w\", err))\n\t\t}\n\t}\n\n\tif err := m.aclMgr.Reset(); err != nil {\n\t\tmerr = multierror.Append(merr, fmt.Errorf(\"reset acl manager: %w\", err))\n\t}\n\tif err := m.router.Reset(); err != nil {\n\t\tmerr = multierror.Append(merr, fmt.Errorf(\"reset router: %w\", err))\n\t}\n\n\t// Appending to merr intentionally blocks DeleteState below so ShutdownState\n\t// stays persisted and the crash-recovery path retries firewalld cleanup.\n\tif err := firewalld.UntrustInterface(m.wgIface.Name()); err != nil {\n\t\tmerr = multierror.Append(merr, err)\n\t}\n\n\t// attempt to delete state only if all other operations succeeded\n\tif merr == nil {\n\t\tif err := stateManager.DeleteState(&ShutdownState{}); err != nil {\n\t\t\tmerr = multierror.Append(merr, fmt.Errorf(\"delete state: %w\", err))\n\t\t}\n\t}\n\n\treturn nberrors.FormatErrorOrNil(merr)\n}\n","sourceCodeStart":338,"sourceCodeEnd":374,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/firewall/iptables/manager_linux.go#L338-L374","documentation":"During Manager.Close, the v4 router.Reset() failed - deleting the v4 NETBIRD routing chains, their jump rules from nat/mangle/filter built-ins, and v4 ipsets. It is the last firewall reset before firewalld.UntrustInterface; as with the sibling resets the error is accumulated, DeleteState is intentionally skipped, and the persisted ShutdownState retries on next start.","triggerScenarios":"Close where a v4 iptables or ipset delete fails - rules already flushed externally (docker/firewalld reload), ipset busy, or non-root stop.","commonSituations":"Host firewall rewrites racing agent shutdown; teardown after an external iptables-restore; repeated Close after partial failure.","solutions":["Restart and cleanly stop the agent; the state-file recovery path finishes removal","Audit leftovers: iptables-save | grep NETBIRD and ipset list","Address the wrapped iptables/ipset error from the log if the failure reproduces on every stop"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"err := mgr.Close(stateManager)\nif err != nil {\n    log.Warnf(\"v4 router teardown incomplete; state persisted for next-start retry: %v\", err)\n}","preventionTips":["Run a restart/stop cycle to let ShutdownState.Cleanup finish chain removal","Audit with iptables-save | grep NETBIRD after failures","Prevent external iptables-restore jobs from racing the agent stop"],"tags":["iptables","firewall","routing","cleanup","netbird","go"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}