{"record":{"id":"a389983e04e2cf66","repo":"netbirdio/netbird","slug":"received-error-w-while-updating-peer-on-interfa","errorCode":null,"errorMessage":"received error \"%w\" while updating peer on interface %s with settings: allowed ips %s, endpoint %s","messagePattern":"received error \"%w\" while updating peer on interface (.+?) with settings: allowed ips (.+?), endpoint (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/iface/configurer/kernel_unix.go","lineNumber":84,"sourceCode":"\tif err != nil {\n\t\treturn err\n\t}\n\tpeer := wgtypes.PeerConfig{\n\t\tPublicKey:         peerKeyParsed,\n\t\tReplaceAllowedIPs: false,\n\t\t// don't replace allowed ips, wg will handle duplicated peer IP\n\t\tAllowedIPs:                  prefixesToIPNets(allowedIps),\n\t\tPersistentKeepaliveInterval: &keepAlive,\n\t\tEndpoint:                    endpoint,\n\t\tPresharedKey:                preSharedKey,\n\t}\n\n\tconfig := wgtypes.Config{\n\t\tPeers: []wgtypes.PeerConfig{peer},\n\t}\n\terr = c.configure(config)\n\tif err != nil {\n\t\treturn fmt.Errorf(`received error \"%w\" while updating peer on interface %s with settings: allowed ips %s, endpoint %s`, err, c.deviceName, allowedIps, endpoint.String())\n\t}\n\treturn nil\n}\n\nfunc (c *KernelConfigurer) RemoveEndpointAddress(peerKey string) error {\n\tpeerKeyParsed, err := wgtypes.ParseKey(peerKey)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\t// Get the existing peer to preserve its allowed IPs\n\texistingPeer, err := c.getPeer(c.deviceName, peerKey)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"get peer: %w\", err)\n\t}\n\n\tremovePeerCfg := wgtypes.PeerConfig{\n\t\tPublicKey: peerKeyParsed,","sourceCodeStart":66,"sourceCodeEnd":102,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/iface/configurer/kernel_unix.go#L66-L102","documentation":"The kernel configurer failed to push a peer update (allowed IPs, endpoint, keepalive, preshared key) to the WireGuard device. The underlying c.configure error comes from wgctrl/netlink and is almost always device-missing (ENOENT after the interface was removed), permission loss, or a malformed field such as an unparseable endpoint or an allowed-IP netmask the kernel rejects. The message includes the peer's allowed IPs and endpoint to make misconfigured peer data identifiable.","triggerScenarios":"Updating a peer on an interface that was concurrently deleted or recreated; endpoint host/port invalid or unreachable at the netlink validation layer; an allowed-IPs entry with a mask that does not match the address family; running without CAP_NET_ADMIN so the update is refused.","commonSituations":"Network map updates arriving while the engine restarts the interface (login, address change, IPv6 toggle); a peer in the management network map carrying a malformed endpoint; agents in restricted containers; version skew where a newer management sends data older wgctrl validates differently.","solutions":["Read the wrapped cause: device ENOENT points to a lifecycle race, EINVAL to bad peer data, EACCES to privileges","Log the allowed IPs and endpoint from the message and cross-check the peer entry in the management network map for family/mask errors","Serialize peer updates with interface bring-up/teardown so updates never target a half-dead device","Verify the process still holds root/CAP_NET_ADMIN","Retry the update after the interface is confirmed present"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// validate peer data before pushing it to the kernel\nfor _, pfx := range allowedIps {\n    if !pfx.IsValid() || (pfx.Addr().Is4() && pfx.Bits() > 32) {\n        return fmt.Errorf(\"bad allowed IP %s\", pfx)\n    }\n}\nif endpoint != nil && endpoint.Port() == 0 {\n    return errors.New(\"peer endpoint has no port\")\n}","typeGuard":"func peerConfigValid(allowedIps []netip.Prefix, endpoint *net.UDPAddr) bool {\n    if endpoint != nil && (endpoint.Port == 0 || endpoint.IP == nil) {\n        return false\n    }\n    for _, p := range allowedIps {\n        if !p.IsValid() {\n            return false\n        }\n    }\n    return true\n}","tryCatchPattern":"if err := configurer.UpdatePeer(peerKey, allowedIps, endpoint, keepAlive, psk); err != nil {\n    if errors.Is(err, syscall.ENOENT) {\n        // device gone: re-run interface bring-up, then retry the update once\n    }\n    return fmt.Errorf(\"update peer %s: %w\", peerKey, err)\n}","preventionTips":["Validate network-map peer data (endpoint host/port, allowed-IP families) before it reaches the configurer","Serialize peer updates against interface restarts with a lifecycle lock","Log the failing allowed IPs/endpoint exactly as the message does, and cross-check them in management"],"tags":["go","netbird","wireguard","kernel","netlink","peers"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}