{"record":{"id":"8b348ea6b637dc0e","repo":"netbirdio/netbird","slug":"delete-state-w","errorCode":null,"errorMessage":"delete state: %w","messagePattern":"delete state: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"info","filePath":"client/firewall/iptables/manager_linux.go","lineNumber":368,"sourceCode":"\t}\n\n\tif err := m.aclMgr.Reset(); err != nil {\n\t\tmerr = multierror.Append(merr, fmt.Errorf(\"reset acl manager: %w\", err))\n\t}\n\tif err := m.router.Reset(); err != nil {\n\t\tmerr = multierror.Append(merr, fmt.Errorf(\"reset router: %w\", err))\n\t}\n\n\t// Appending to merr intentionally blocks DeleteState below so ShutdownState\n\t// stays persisted and the crash-recovery path retries firewalld cleanup.\n\tif err := firewalld.UntrustInterface(m.wgIface.Name()); err != nil {\n\t\tmerr = multierror.Append(merr, err)\n\t}\n\n\t// attempt to delete state only if all other operations succeeded\n\tif merr == nil {\n\t\tif err := stateManager.DeleteState(&ShutdownState{}); err != nil {\n\t\t\tmerr = multierror.Append(merr, fmt.Errorf(\"delete state: %w\", err))\n\t\t}\n\t}\n\n\treturn nberrors.FormatErrorOrNil(merr)\n}\n\n// AllowNetbird allows netbird interface traffic.\n// This is called when USPFilter wraps the native firewall, adding blanket accept\n// rules so that packet filtering is handled in userspace instead of by netfilter.\nfunc (m *Manager) AllowNetbird() error {\n\tvar merr *multierror.Error\n\tif _, err := m.AddPeerFiltering(nil, net.IP{0, 0, 0, 0}, firewall.ProtocolALL, nil, nil, firewall.ActionAccept, \"\"); err != nil {\n\t\tmerr = multierror.Append(merr, fmt.Errorf(\"allow netbird v4 interface traffic: %w\", err))\n\t}\n\tif m.hasIPv6() {\n\t\tif _, err := m.AddPeerFiltering(nil, net.IPv6zero, firewall.ProtocolALL, nil, nil, firewall.ActionAccept, \"\"); err != nil {\n\t\t\tmerr = multierror.Append(merr, fmt.Errorf(\"allow netbird v6 interface traffic: %w\", err))\n\t\t}","sourceCodeStart":350,"sourceCodeEnd":386,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/firewall/iptables/manager_linux.go#L350-L386","documentation":"Final step of Manager.Close, executed only when every other cleanup succeeded: stateManager.DeleteState removes the persisted 'iptables_state' ShutdownState entry. Its failure means the state file/directory could not be written or removed (filesystem error). The consequence is benign by design - the stale state makes the next startup re-run ShutdownState.Cleanup, which tolerates already-absent rules and ipsets.","triggerScenarios":"Close reaching DeleteState and the state manager failing to persist the removal - read-only state directory, disk full, permission change, or the state file deleted underneath the manager.","commonSituations":"State directory on a full or read-only filesystem; permissions changed between start and stop; containerized agent with an ephemeral or overlaid state path.","solutions":["No immediate action needed: the next start re-runs cleanup idempotently","Check the agent state directory permissions and free space","Delete the stale iptables_state entry/file manually if startup noise is unacceptable"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// ensure the state directory is writable before shutdown\ndir := statemanager.GetDefaultDirectory() // or your configured state path\nif info, err := os.Stat(dir); err != nil || !info.IsDir() {\n    log.Warnf(\"state dir unhealthy, shutdown state may persist: %v\", err)\n}","typeGuard":null,"tryCatchPattern":"if err := mgr.Close(stateManager); err != nil {\n    if strings.Contains(err.Error(), \"delete state\") {\n        // cleanup itself succeeded; only the state-file removal failed. Benign:\n        // next start re-runs an idempotent cleanup.\n        log.Debugf(\"stale shutdown state kept: %v\", err)\n        return nil\n    }\n    return err\n}","preventionTips":["Keep the agent state directory writable and on a non-full filesystem","Recognize this as benign when it is the only Close error","Clean stale state files when re-provisioning hosts to silence redundant startup cleanup"],"tags":["iptables","firewall","state","cleanup","filesystem","netbird","go"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}