{"record":{"id":"a5a82c60d7772a97","repo":"netbirdio/netbird","slug":"remove-legacy-forwarding-rule-v","errorCode":null,"errorMessage":"remove legacy forwarding rule: %v","messagePattern":"remove legacy forwarding rule: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/firewall/iptables/router_linux.go","lineNumber":365,"sourceCode":"// GetLegacyManagement returns the current legacy management mode\nfunc (r *router) GetLegacyManagement() bool {\n\treturn r.legacyManagement\n}\n\n// SetLegacyManagement sets the route manager to use legacy management mode\nfunc (r *router) SetLegacyManagement(isLegacy bool) {\n\tr.legacyManagement = isLegacy\n}\n\n// RemoveAllLegacyRouteRules removes all legacy routing rules for mgmt servers pre route acls\nfunc (r *router) RemoveAllLegacyRouteRules() error {\n\tvar merr *multierror.Error\n\tfor k, rule := range r.rules {\n\t\tif !strings.HasPrefix(k, firewall.ForwardingFormatPrefix) {\n\t\t\tcontinue\n\t\t}\n\t\tif err := r.iptablesClient.DeleteIfExists(tableFilter, chainRTFWDIN, rule...); err != nil {\n\t\t\tmerr = multierror.Append(merr, fmt.Errorf(\"remove legacy forwarding rule: %v\", err))\n\t\t} else {\n\t\t\tdelete(r.rules, k)\n\t\t}\n\t}\n\n\tr.updateState()\n\n\treturn nberrors.FormatErrorOrNil(merr)\n}\n\nfunc (r *router) Reset() error {\n\tvar merr *multierror.Error\n\tif err := r.cleanUpDefaultForwardRules(); err != nil {\n\t\tmerr = multierror.Append(merr, err)\n\t}\n\n\tif err := r.ipsetCounter.Flush(); err != nil {\n\t\tmerr = multierror.Append(merr, err)","sourceCodeStart":347,"sourceCodeEnd":383,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/firewall/iptables/router_linux.go#L347-L383","documentation":"Accumulated by router.RemoveAllLegacyRouteRules when iptablesClient.DeleteIfExists fails for any rule whose key starts with the ForwardingFormat prefix. Unlike the per-rule paths, this sweeps all legacy rules and collects failures in a go-multierror, deleting only the map entries whose kernel delete succeeded. Leftover failures mean permissive '-j ACCEPT' forwarding rules survive.","triggerScenarios":"Called when disconnecting from a legacy management or transitioning to route ACLs: iterates r.rules, deletes each legacy forwarding spec from NETBIRD-RT-FWD-IN. Fails per rule on iptables invocation errors (lock, backend, missing chain handled as success by DeleteIfExists only when the rule is absent).","commonSituations":"netbird down after chains were partially flushed manually; iptables backend changed mid-session; host under heavy parallel firewall churn.","solutions":["After the failure, list leftovers: sudo iptables -S NETBIRD-RT-FWD-IN and delete each ACCEPT rule manually","Retry RemoveAllLegacyRouteRules (idempotent: DeleteIfExists skips absent rules)","Restart the agent and immediately run down/up to resynchronize state","Check the multierror body to see which specific rule specs failed"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := r.RemoveAllLegacyRouteRules(); err != nil {\n\t// fall back to a manual sweep so no permissive ACCEPT rules survive\n\tlog.Warnf(\"automatic legacy sweep incomplete: %v; verify NETBIRD-RT-FWD-IN\", err)\n}","preventionTips":["After a failed sweep always inspect 'iptables -S NETBIRD-RT-FWD-IN' for -j ACCEPT leftovers","Treat surviving legacy ACCEPT rules as a security issue and remove them manually","Retry the sweep; it is idempotent"],"tags":["iptables","legacy","cleanup","multierror","linux","netbird"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}