{"record":{"id":"a3a136028d3433a1","repo":"netbirdio/netbird","slug":"remove-legacy-forwarding-rule-s-s-v","errorCode":null,"errorMessage":"remove legacy forwarding rule %s -> %s: %v","messagePattern":"remove legacy forwarding rule (.+?) -> (.+?): (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/firewall/iptables/router_linux.go","lineNumber":335,"sourceCode":"\t\treturn err\n\t}\n\n\trule := []string{\"-s\", pair.Source.String(), \"-d\", pair.Destination.String(), \"-j\", routingFinalForwardJump}\n\tif err := r.iptablesClient.Append(tableFilter, chainRTFWDIN, rule...); err != nil {\n\t\treturn fmt.Errorf(\"add legacy forwarding rule %s -> %s: %v\", pair.Source, pair.Destination, err)\n\t}\n\n\tr.rules[ruleKey] = rule\n\n\treturn nil\n}\n\nfunc (r *router) removeLegacyRouteRule(pair firewall.RouterPair) error {\n\truleKey := firewall.GenKey(firewall.ForwardingFormat, pair)\n\n\tif rule, exists := r.rules[ruleKey]; exists {\n\t\tif err := r.iptablesClient.DeleteIfExists(tableFilter, chainRTFWDIN, rule...); err != nil {\n\t\t\treturn fmt.Errorf(\"remove legacy forwarding rule %s -> %s: %v\", pair.Source, pair.Destination, err)\n\t\t}\n\t\tdelete(r.rules, ruleKey)\n\n\t\tif err := r.decrementSetCounter(rule); err != nil {\n\t\t\treturn fmt.Errorf(\"decrement ipset counter: %w\", err)\n\t\t}\n\t}\n\n\treturn nil\n}\n\n// GetLegacyManagement returns the current legacy management mode\nfunc (r *router) GetLegacyManagement() bool {\n\treturn r.legacyManagement\n}\n\n// SetLegacyManagement sets the route manager to use legacy management mode\nfunc (r *router) SetLegacyManagement(isLegacy bool) {","sourceCodeStart":317,"sourceCodeEnd":353,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/firewall/iptables/router_linux.go#L317-L353","documentation":"Returned by router.removeLegacyRouteRule when iptablesClient.DeleteIfExists(tableFilter, NETBIRD-RT-FWD-IN, rule...) fails for a tracked legacy rule. DeleteIfExists tolerates an absent rule, so the error means the iptables invocation itself failed, not that the rule was missing.","triggerScenarios":"RemoveNatRule/RemoveAllLegacyRouteRules path on a legacy rule previously stored in r.rules. Fires on xtables lock contention, iptables backend switched legacy/nft after agent start, or the chain deleted out-of-band causing an opaque backend error.","commonSituations":"Config management flushing NETBIRD chains concurrently; host updated iptables alternatives while the daemon ran; SELinux denying the iptables exec on teardown.","solutions":["Retry the removal; DeleteIfExists makes it idempotent","Verify with sudo iptables -S NETBIRD-RT-FWD-IN and manually delete leftovers: sudo iptables -D NETBIRD-RT-FWD-IN -s <src> -d <dst> -j ACCEPT","Restart the agent after any iptables backend change","Check /run/xtables.lock holders if failures cluster"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := r.iptablesClient.DeleteIfExists(tableFilter, chainRTFWDIN, rule...); err != nil {\n\tif strings.Contains(err.Error(), \"does not exist\") || strings.Contains(err.Error(), \"No chain\") {\n\t\treturn nil // already cleaned; converge\n\t}\n\treturn fmt.Errorf(\"remove legacy forwarding rule: %v\", err)\n}","preventionTips":["Retry removals; DeleteIfExists tolerates absent rules","Restart the agent after changing the host iptables backend","Audit NETBIRD-RT-FWD-IN after failed sweeps"],"tags":["iptables","legacy","cleanup","linux","netbird"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}