{"record":{"id":"999d8e3bfe3bf6c1","repo":"netbirdio/netbird","slug":"delete-ip-from-ipset-s-w","errorCode":null,"errorMessage":"delete IP from ipset %s: %w","messagePattern":"delete IP from ipset (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/firewall/iptables/acl_linux.go","lineNumber":591,"sourceCode":"\t\treturn fmt.Errorf(\"add IP to ipset %s: %w\", name, err)\n\t}\n\n\treturn nil\n}\n\nfunc (m *aclManager) delFromIPSet(name string, ip net.IP) error {\n\tcidr := uint8(32)\n\tif ip.To4() == nil {\n\t\tcidr = 128\n\t}\n\n\tentry := &ipset.Entry{\n\t\tIP:   ip,\n\t\tCIDR: cidr,\n\t}\n\n\tif err := ipset.Del(name, entry); err != nil {\n\t\treturn fmt.Errorf(\"delete IP from ipset %s: %w\", name, err)\n\t}\n\n\treturn nil\n}\n\nfunc (m *aclManager) flushIPSet(name string) error {\n\treturn ipset.Flush(name)\n}\n\nfunc (m *aclManager) destroyIPSet(name string) error {\n\treturn ipset.Destroy(name)\n}\n","sourceCodeStart":573,"sourceCodeEnd":604,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/firewall/iptables/acl_linux.go#L573-L604","documentation":"The delFromIPSet helper's netlink DEL of an entry failed. Common cases: the element is not in the set (ErrNotExist, typically a kernel/memory desync since callers check their own map first), the set itself is gone, the entry family mismatches the set, or privileges are missing. Appears wrapped by callers as 'delete ip from ipset: delete IP from ipset <name>: ...'.","triggerScenarios":"DeletePeerRule after external `ipset flush`; deleting from a set already destroyed while the manager's ips map still lists the element; v4/v6 family mismatch on the Entry; non-root execution.","commonSituations":"Post-restart state where persisted maps outlive kernel sets; operators flushing ipsets; cleanup code running in a changed network namespace.","solutions":["Treat ErrNotExist (element or set) as success and continue.","Recreate the set and retry when the whole set is missing and more operations follow.","Verify family match and privileges before issuing deletes.","Reconcile with Reset instead of hand-deleting after external changes."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// confirm presence before DEL to make the call idempotent\nif err := ipset.Test(name, &ipset.Entry{IP: ip, CIDR: cidr}); err != nil {\n    if errors.Is(err, ipset.ErrElementNotExist) || errors.Is(err, ipset.ErrSetNotExist) {\n        // nothing to delete in the kernel; update local state only\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := mgr.DeletePeerRule(rule); err != nil {\n    if strings.Contains(err.Error(), \"delete IP from ipset\") {\n        if errors.Is(err, ipset.ErrElementNotExist) || errors.Is(err, ipset.ErrSetNotExist) {\n            err = nil // desired state already holds\n        }\n    }\n}","preventionTips":["Treat not-found on delete as success everywhere you touch ipsets.","Keep manager maps and the kernel in sync via Reset rather than ad-hoc external edits.","Check family match before constructing the Entry.","Run with CAP_NET_ADMIN; EPERM on DEL is otherwise indistinguishable from real failures at the call site."],"tags":["go","linux","ipset","netlink","firewall","idempotency","netbird"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}