{"record":{"id":"944da2d9857ddce7","repo":"netbirdio/netbird","slug":"create-set-s-w","errorCode":null,"errorMessage":"create set %s: %w","messagePattern":"create set (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/firewall/iptables/router_linux.go","lineNumber":244,"sourceCode":"\t\t}\n\t}\n\n\treturn nberrors.FormatErrorOrNil(merr)\n}\n\nfunc (r *router) findSets(rule []string) []string {\n\tvar sets []string\n\tfor i, arg := range rule {\n\t\tif arg == \"-m\" && i+3 < len(rule) && rule[i+1] == \"set\" && rule[i+2] == matchSet {\n\t\t\tsets = append(sets, rule[i+3])\n\t\t}\n\t}\n\treturn sets\n}\n\nfunc (r *router) createIpSet(setName string, sources []netip.Prefix) error {\n\tif err := r.createIPSet(setName); err != nil {\n\t\treturn fmt.Errorf(\"create set %s: %w\", setName, err)\n\t}\n\n\tfor _, prefix := range sources {\n\t\tif err := r.addPrefixToIPSet(setName, prefix); err != nil {\n\t\t\treturn fmt.Errorf(\"add element to set %s: %w\", setName, err)\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc (r *router) deleteIpSet(setName string) error {\n\tif err := r.destroyIPSet(setName); err != nil {\n\t\treturn fmt.Errorf(\"destroy set %s: %w\", setName, err)\n\t}\n\n\tlog.Debugf(\"Deleted unused ipset %s\", setName)\n\treturn nil","sourceCodeStart":226,"sourceCodeEnd":262,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/firewall/iptables/router_linux.go#L226-L262","documentation":"Returned by router.createIpSet in the NetBird iptables firewall manager when the kernel refuses to create an ipset. It wraps createIPSet, which calls ipset.Create (lrh3321/ipset-go, netlink) with TypeHashNet, Replace:true and FamilyIPV6 on the v6 router. Creating a set requires root privileges (CAP_NET_ADMIN), the nfnetlink/ip_set/ip_set_hash_net kernel modules, and a valid set name (kernel limit 31 chars).","triggerScenarios":"AddRouteFiltering (or refcounter.Increment from UpdateSet) with more than one source prefix makes the router create a 'nb-route-<id>[-v6]' hash:net set. It fails when: the agent lacks CAP_NET_ADMIN (container without NET_ADMIN, or not run via sudo); the ipset kernel modules/CONFIG_IP_SET are absent; netlink is unavailable in the sandbox; or the generated name exceeds the kernel ipset name limit.","commonSituations":"Running netbird up in Docker/LXC without --cap-add NET_ADMIN; minimal cloud/WSL2 kernels without ipset modules; hosts where ipset was never loaded (verify with 'lsmod | grep ip_set'); environments where a third party already created a conflicting set name.","solutions":["Run the agent as root, and in containers add NET_ADMIN (docker run --cap-add NET_ADMIN)","Load kernel modules: modprobe nfnetlink ipset ip_set_hash_net (or check CONFIG_IP_SET in kernel config)","Verify manual creation works: sudo ipset create probe hash:net && sudo ipset destroy probe","Check dmesg/journal for netlink 'Operation not permitted' or 'No such file or directory' module errors","Confirm no other netbird instance already owns the set names (ipset list -t)"],"exampleFix":"# before: container without netfilter rights\ndocker run netbird/netbird up\n# after\ndocker run --cap-add NET_ADMIN --sysctl net.ipv4.ip_forward=1 netbird/netbird up","handlingStrategy":"validation","validationCode":"// probe ipset support before starting the route firewall\nfunc ipsetAvailable() error {\n\tif os.Geteuid() != 0 {\n\t\treturn fmt.Errorf(\"agent must run as root for ipset management\")\n\t}\n\tconst probe = \"nb-probe-set\"\n\tif err := ipset.Create(probe, ipset.TypeHashNet, ipset.CreateOptions{Replace: true}); err != nil {\n\t\treturn fmt.Errorf(\"ipset create probe: %w\", err)\n\t}\n\treturn ipset.Destroy(probe)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Run containers with --cap-add NET_ADMIN and the agent as root","Preload nfnetlink/ipset/ip_set_hash_net modules in minimal images","Check 'lsmod | grep ip_set' or a manual 'ipset create probe hash:net' as a preflight in deployment scripts","Keep set names within the kernel's 31-character ipset name limit"],"tags":["iptables","ipset","linux","netfilter","permissions","netbird"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}