{"record":{"id":"a71aeaa0c95b3905","repo":"hashicorp/nomad","slug":"failed-to-initialize-table-forwarding-rules-v","errorCode":null,"errorMessage":"failed to initialize table forwarding rules: %v","messagePattern":"failed to initialize table forwarding rules: (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/allocrunner/networking_bridge_linux.go","lineNumber":125,"sourceCode":"\t\t}\n\t}\n\n\tipt, err := b.newIPTables(structs.NodeNetworkAF_IPv4)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif err = ensureChainRule(ipt, b.bridgeName, b.allocSubnetIPv4); err != nil {\n\t\treturn err\n\t}\n\n\treturn nil\n}\n\n// Setup calls the CNI plugins with the add action\nfunc (b *bridgeNetworkConfigurator) Setup(ctx context.Context, alloc *structs.Allocation, spec *drivers.NetworkIsolationSpec, created bool) (*structs.AllocNetworkStatus, error) {\n\tif err := b.ensureForwardingRules(); err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to initialize table forwarding rules: %v\", err)\n\t}\n\n\treturn b.cni.Setup(ctx, alloc, spec, created)\n}\n\n// Teardown calls the CNI plugins with the delete action\nfunc (b *bridgeNetworkConfigurator) Teardown(ctx context.Context, alloc *structs.Allocation, spec *drivers.NetworkIsolationSpec) error {\n\treturn b.cni.Teardown(ctx, alloc, spec)\n}\n\nfunc buildNomadBridgeNetConfig(b bridgeNetworkConfigurator, withConsulCNI bool) ([]byte, error) {\n\tconf := cni.NewNomadBridgeConflist(cni.NomadBridgeConfig{\n\t\tBridgeName:     b.bridgeName,\n\t\tAdminChainName: cniAdminChainName,\n\t\tIPv4Subnet:     b.allocSubnetIPv4,\n\t\tIPv6Subnet:     b.allocSubnetIPv6,\n\t\tHairpinMode:    b.hairpinMode,\n\t\tConsulCNI:      withConsulCNI,","sourceCodeStart":107,"sourceCodeEnd":143,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/client/allocrunner/networking_bridge_linux.go#L107-L143","documentation":"bridgeNetworkConfigurator.Setup installs iptables forwarding rules (via ensureForwardingRules) before invoking CNI. If that initialization fails, Setup returns this error wrapping the cause. It prevents allocations from starting on a bridge whose host forwarding rules could not be created, since traffic would be dropped or unsafe.","triggerScenarios":"ensureForwardingRules() fails inside bridgeNetworkConfigurator.Setup: iptables binary missing, insufficient permissions (not root / missing CAP_NET_ADMIN), iptables backend (nft vs legacy) problems, or IPTables constructor error.","commonSituations":"Running the Nomad agent in a container without NET_ADMIN; host without iptables installed; hosts using nftables-only with no iptables-nft shim; selinux denials blocking iptables exec.","solutions":["Install iptables on the host and ensure the Nomad agent runs with sufficient privileges (root or CAP_NET_ADMIN).","Check the wrapped error for the iptables exec output and fix the underlying rule-creation failure.","If running Nomad in a container, run with --cap-add=NET_ADMIN -v /lib/modules:/lib/modules.","Ensure iptables-legacy/iptables-nft match the host firewall backend.","Verify no security module (SELinux/AppArmor) blocks iptables for the agent."],"exampleFix":"# before (error on host)\n$ iptables --version\nbash: iptables: command not found\n# after\n$ apt-get install -y iptables","handlingStrategy":"try-catch","validationCode":"// node pre-flight before starting the Nomad agent\nsh -c 'command -v iptables && iptables -L -n >/dev/null' || echo 'iptables unavailable'","typeGuard":null,"tryCatchPattern":"alloc, err := cfg.Setup(ctx, alloc, spec, created)\nif err != nil && strings.Contains(err.Error(), \"forwarding rules\") {\n  // surface iptables diagnostic: run `iptables -L` and check CAP_NET_ADMIN\n  return fmt.Errorf(\"bridge setup blocked: %w\", err)\n}","preventionTips":["Install iptables and grant the agent NET_ADMIN on all bridge-network clients.","Run Nomad on the host (not in a netns-restricted container) for bridge networking.","Keep iptables backend consistent (legacy vs nft) across the fleet."],"tags":["nomad","iptables","bridge","cni","networking"],"backgroundTag":"iptables-forwarding-rules-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}