{"record":{"id":"9fbafc9cc8f40ab1","repo":"netbirdio/netbird","slug":"delete-block-rule-w","errorCode":null,"errorMessage":"delete block rule: %w","messagePattern":"delete block rule: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"client/firewall/uspfilter/filter.go","lineNumber":1793,"sourceCode":"\treturn nil\n}\n\nfunc (m *Manager) DisableRouting() error {\n\tm.mutex.Lock()\n\tdefer m.mutex.Unlock()\n\n\tfwder := m.forwarder.Load()\n\tif fwder == nil {\n\t\treturn nil\n\t}\n\n\tm.routingEnabled.Store(false)\n\tm.nativeRouter.Store(false)\n\n\tvar merr *multierror.Error\n\tfor _, rule := range m.blockRules {\n\t\tif err := m.deleteRouteRule(rule); err != nil {\n\t\t\tmerr = multierror.Append(merr, fmt.Errorf(\"delete block rule: %w\", err))\n\t\t}\n\t}\n\tm.blockRules = nil\n\n\tif m.netstack && m.localForwarding {\n\t\treturn nberrors.FormatErrorOrNil(merr)\n\t}\n\n\tfwder.Stop()\n\tm.forwarder.Store(nil)\n\n\tlog.Debug(\"forwarder stopped\")\n\n\treturn nberrors.FormatErrorOrNil(merr)\n}\n\n// RegisterNetstackService registers a service as listening on the netstack for the given protocol and port\nfunc (m *Manager) RegisterNetstackService(protocol nftypes.Protocol, port uint16) {","sourceCodeStart":1775,"sourceCodeEnd":1811,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/firewall/uspfilter/filter.go#L1775-L1811","documentation":"Accumulated into a multierror by Manager.DisableRouting (client/firewall/uspfilter/filter.go:1793) when m.deleteRouteRule(rule) fails for one of the persisted blockRules (installed by blockInvalidRouted). These are in-memory uspfilter rules, so deletion failing indicates the rule was already removed (stale blockRules after a Reset), the manager's rule set was replaced, or the rule ID lookup misses. Remaining rules are still attempted, m.blockRules is set to nil regardless, and the forwarder is stopped (unless netstack+localForwarding).","triggerScenarios":"DisableRouting called twice; EnableRouting failed earlier leaving partial blockRules that reference rules Reset already cleared; concurrent ACL rebuild swapping the rule set under DisableRouting.","commonSituations":"Agent shutdown after a failed EnableRouting; engine reconfiguration calling Disable then Enable rapidly; crash-recovery paths where blockRules were deserialized from stale state.","solutions":["Make DisableRouting idempotent: treat 'rule not found' from deleteRouteRule as success for that rule","If the error persists, call manager Reset to rebuild uspfilter state cleanly instead of retrying DisableRouting on stale rules","Keep Enable/DisableRouting strictly serialized under the manager mutex and never clear blockRules on a path that did not attempt deletion","Inspect the multierror entries to see which rule IDs failed and re-run once after state settles"],"exampleFix":"// before\nfor _, rule := range m.blockRules {\n    if err := m.deleteRouteRule(rule); err != nil {\n        merr = multierror.Append(merr, fmt.Errorf(\"delete block rule: %w\", err))\n    }\n}\n// after - tolerate already-removed rules during teardown\nfor _, rule := range m.blockRules {\n    if err := m.deleteRouteRule(rule); err != nil && !errors.Is(err, firewall.ErrRuleNotFound) {\n        merr = multierror.Append(merr, fmt.Errorf(\"delete block rule %s: %w\", rule.ID(), err))\n    }\n}","handlingStrategy":"try-catch","validationCode":"if !fw.RoutingEnabled() {\n    return nil // nothing was installed; skip teardown\n}","typeGuard":null,"tryCatchPattern":"if err := fw.DisableRouting(); err != nil {\n    for _, e := range unwrapMulti(err) {\n        if strings.Contains(e.Error(), \"delete block rule\") {\n            log.Warnf(\"block rule possibly stale: %v\", e)\n            continue\n        }\n        return err\n    }\n    return nil\n}","preventionTips":["Make teardown idempotent: missing rules during deletion are success","Never call DisableRouting concurrently with Reset","If stale rules persist, manager Reset rebuilds uspfilter state wholesale instead of retrying deletes"],"tags":["uspfilter","routing","cleanup","idempotency"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}