{"record":{"id":"91f71c08e167d3a3","repo":"netbirdio/netbird","slug":"create-v6-router-w","errorCode":null,"errorMessage":"create v6 router: %w","messagePattern":"create v6 router: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/firewall/iptables/manager_linux.go","lineNumber":88,"sourceCode":"\tif wgIface.Address().HasIPv6() {\n\t\tif err := m.createIPv6Components(wgIface, mtu); err != nil {\n\t\t\treturn nil, fmt.Errorf(\"create IPv6 firewall: %w\", err)\n\t\t}\n\t}\n\n\treturn m, nil\n}\n\nfunc (m *Manager) createIPv6Components(wgIface iFaceMapper, mtu uint16) error {\n\tip6Client, err := iptables.NewWithProtocol(iptables.ProtocolIPv6)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"init ip6tables: %w\", err)\n\t}\n\tm.ipv6Client = ip6Client\n\n\tm.router6, err = newRouter(ip6Client, wgIface, mtu)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"create v6 router: %w\", err)\n\t}\n\n\t// Share the same IP forwarding state with the v4 router, since\n\t// Forwarding refcounter is per-family but shared between v4 and v6 routers.\n\tm.router6.ipFwdState = m.router.ipFwdState\n\n\tm.aclMgr6, err = newAclManager(ip6Client, wgIface)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"create v6 acl manager: %w\", err)\n\t}\n\n\treturn nil\n}\n\nfunc (m *Manager) hasIPv6() bool {\n\treturn m.ipv6Client != nil\n}\n","sourceCodeStart":70,"sourceCodeEnd":106,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/firewall/iptables/manager_linux.go#L70-L106","documentation":"Inside createIPv6Components, newRouter for the ip6tables client failed and is wrapped as 'create v6 router'. The current newRouter implementation performs no fallible work (struct allocation plus a refcounter) and returns nil, so on stock code this wrap is unreachable; hitting it implies a fork or binary/source skew. The realistic v6 creation failures on stock builds are errors 498 (ip6tables init) and 500-series init errors instead.","triggerScenarios":"Not reachable with the present newRouter (returns nil error). On modified builds, any fallible work added to v6 router construction (chain existence checks, ipset probing over ip6tables) failing on privileges or missing kernel v6 tables would land here.","commonSituations":"Version mismatch between compiled manager_linux.go and router_linux.go; custom forks that moved init-time work into the constructor.","solutions":["Confirm the binary matches the source tree (rebuild); on stock code this error cannot occur.","On forks, inspect what newRouter now does and fix the underlying ip6tables privilege/module issue.","Ensure IPv6 kernel support and root regardless, since the surrounding v6 path requires both."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// stock newRouter cannot fail; for forks with fallible v6 construction, pre-check:\nif _, err := exec.LookPath(\"ip6tables\"); err != nil {\n    return fmt.Errorf(\"v6 router construction prerequisites missing: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"if _, err := iptablesMgr.Create(wgIface, mtu); err != nil {\n    if strings.Contains(err.Error(), \"create v6 router\") {\n        // unexpected on stock builds: verify source/binary alignment and v6 prerequisites\n        log.Errorf(\"v6 router construction failed: %v\", err)\n    }\n}","preventionTips":["Build from a consistent source tree so manager_linux.go and router_linux.go cannot diverge.","Treat this error as a fork/skew signal on stock builds and gather version evidence.","Keep constructors allocation-only in forks; defer fallible v6 setup to init() with precise wrapping."],"tags":["go","linux","ip6tables","ipv6","firewall","startup","netbird"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}