{"record":{"id":"950d0a2b7b82dd77","repo":"netbirdio/netbird","slug":"insert-established-rule-w","errorCode":null,"errorMessage":"insert established rule: %w","messagePattern":"insert established rule: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/firewall/iptables/router_linux.go","lineNumber":463,"sourceCode":"\t\t{chainRTFWDOUT, tableFilter},\n\t\t{chainRTPRE, tableMangle},\n\t\t{chainRTNAT, tableNat},\n\t\t{chainRTRDR, tableNat},\n\t\t{chainRTMSSCLAMP, tableMangle},\n\t} {\n\t\t// Fallback: clear chains that survived an unclean shutdown.\n\t\tif ok, _ := r.iptablesClient.ChainExists(chainInfo.table, chainInfo.chain); ok {\n\t\t\tif err := r.iptablesClient.ClearAndDeleteChain(chainInfo.table, chainInfo.chain); err != nil {\n\t\t\t\tlog.Warnf(\"clear stale chain %s in %s: %v\", chainInfo.chain, chainInfo.table, err)\n\t\t\t}\n\t\t}\n\t\tif err := r.iptablesClient.NewChain(chainInfo.table, chainInfo.chain); err != nil {\n\t\t\treturn fmt.Errorf(\"create chain %s in table %s: %w\", chainInfo.chain, chainInfo.table, err)\n\t\t}\n\t}\n\n\tif err := r.insertEstablishedRule(chainRTFWDIN); err != nil {\n\t\treturn fmt.Errorf(\"insert established rule: %w\", err)\n\t}\n\n\tif err := r.insertEstablishedRule(chainRTFWDOUT); err != nil {\n\t\treturn fmt.Errorf(\"insert established rule: %w\", err)\n\t}\n\n\tif err := r.addPostroutingRules(); err != nil {\n\t\treturn fmt.Errorf(\"add static nat rules: %w\", err)\n\t}\n\n\tif err := r.addJumpRules(); err != nil {\n\t\treturn fmt.Errorf(\"add jump rules: %w\", err)\n\t}\n\n\tif err := r.addMSSClampingRules(); err != nil {\n\t\tlog.Errorf(\"failed to add MSS clamping rules: %s\", err)\n\t}\n","sourceCodeStart":445,"sourceCodeEnd":481,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/firewall/iptables/router_linux.go#L445-L481","documentation":"Returned by router.createContainers when insertEstablishedRule(NETBIRD-RT-FWD-OUT) fails: identical INSERT of the conntrack established rule into the outbound filter chain. The message is byte-for-byte the same as error 557's wrap ('insert established rule'), so logs alone do not say which chain failed; the chain must be inferred from ordering (it is the second call, after FWD-IN succeeded).","triggerScenarios":"createContainers proceeding past the FWD-IN insert and failing on FWD-OUT: same causes, i.e. missing xt_conntrack, chain removed between creation and insert, or xtables lock contention hitting the second statement.","commonSituations":"Same environments as 557; intermittent lock contention that only catches the later insert; note the failure leaves FWD-IN populated with no rollback of earlier chains (createContainers returns the error up to init).","solutions":["Apply the 557 fixes (module, single instance, lock)","Distinguish the failing chain by position: the error after 'insert established rule' during init is FWD-OUT when FWD-IN already succeeded","Verify both chains: sudo iptables -S NETBIRD-RT-FWD-IN; sudo iptables -S NETBIRD-RT-FWD-OUT","Restart the agent; init recreates and repopulates both chains"],"exampleFix":"// before (router_linux.go:463-468): identical messages hide the chain\nif err := r.insertEstablishedRule(chainRTFWDIN); err != nil {\n\treturn fmt.Errorf(\"insert established rule: %w\", err)\n}\nif err := r.insertEstablishedRule(chainRTFWDOUT); err != nil {\n\treturn fmt.Errorf(\"insert established rule: %w\", err)\n}\n// after\nif err := r.insertEstablishedRule(chainRTFWDIN); err != nil {\n\treturn fmt.Errorf(\"insert established rule into %s: %w\", chainRTFWDIN, err)\n}\nif err := r.insertEstablishedRule(chainRTFWDOUT); err != nil {\n\treturn fmt.Errorf(\"insert established rule into %s: %w\", chainRTFWDOUT, err)\n}","handlingStrategy":"validation","validationCode":"# verify the second chain explicitly since the error text is ambiguous\nsudo iptables -S NETBIRD-RT-FWD-OUT","typeGuard":null,"tryCatchPattern":"if err := r.insertEstablishedRule(chainRTFWDOUT); err != nil {\n\t// include the chain in context when wrapping; message alone is ambiguous\n\treturn fmt.Errorf(\"insert established rule into %s: %w\", chainRTFWDOUT, err)\n}","preventionTips":["Include the target chain in wrapped error context","Same preflight as FWD-IN: xt_conntrack must be present","Check both FWD chains after init failures to locate the real one"],"tags":["iptables","conntrack","initialization","observability","linux","netbird"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}