{"record":{"id":"accb878961450c67","repo":"netbirdio/netbird","slug":"allow-netbird-v6-interface-traffic-w","errorCode":null,"errorMessage":"allow netbird v6 interface traffic: %w","messagePattern":"allow netbird v6 interface traffic: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/firewall/iptables/manager_linux.go","lineNumber":385,"sourceCode":"\t\tif err := stateManager.DeleteState(&ShutdownState{}); err != nil {\n\t\t\tmerr = multierror.Append(merr, fmt.Errorf(\"delete state: %w\", err))\n\t\t}\n\t}\n\n\treturn nberrors.FormatErrorOrNil(merr)\n}\n\n// AllowNetbird allows netbird interface traffic.\n// This is called when USPFilter wraps the native firewall, adding blanket accept\n// rules so that packet filtering is handled in userspace instead of by netfilter.\nfunc (m *Manager) AllowNetbird() error {\n\tvar merr *multierror.Error\n\tif _, err := m.AddPeerFiltering(nil, net.IP{0, 0, 0, 0}, firewall.ProtocolALL, nil, nil, firewall.ActionAccept, \"\"); err != nil {\n\t\tmerr = multierror.Append(merr, fmt.Errorf(\"allow netbird v4 interface traffic: %w\", err))\n\t}\n\tif m.hasIPv6() {\n\t\tif _, err := m.AddPeerFiltering(nil, net.IPv6zero, firewall.ProtocolALL, nil, nil, firewall.ActionAccept, \"\"); err != nil {\n\t\t\tmerr = multierror.Append(merr, fmt.Errorf(\"allow netbird v6 interface traffic: %w\", err))\n\t\t}\n\t}\n\n\tif err := firewalld.TrustInterface(m.wgIface.Name()); err != nil {\n\t\tlog.Warnf(\"failed to trust interface in firewalld: %v\", err)\n\t}\n\n\treturn nberrors.FormatErrorOrNil(merr)\n}\n\n// Flush doesn't need to be implemented for this manager\nfunc (m *Manager) Flush() error { return nil }\n\n// SetLogLevel sets the log level for the firewall manager\nfunc (m *Manager) SetLogLevel(log.Level) {\n\t// not supported\n}\n","sourceCodeStart":367,"sourceCodeEnd":403,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/firewall/iptables/manager_linux.go#L367-L403","documentation":"IPv6 counterpart of the blanket overlay accept in AllowNetbird: with hasIPv6() true it appends an ACCEPT for net.IPv6zero through aclMgr6.AddPeerFiltering. Failure means the v6 accept rule could not be installed, so v6 overlay traffic may be dropped by the kernel chain while userspace filtering believes it is pre-allowed. Accumulated alongside the v4 result and returned as a multierror.","triggerScenarios":"AllowNetbird on a v6-capable manager where the ip6tables append fails - v6 ACL chain missing after external flush or ip6tables erroring mid-operation.","commonSituations":"Firewalld/ip6tables-restore rewrites during agent startup; v6 chains removed between Init and AllowNetbird; flaky ip6tables on older kernels.","solutions":["Restart the agent so Init rebuilds v6 chains and AllowNetbird retries","Verify with ip6tables -S NETBIRD-ACL-INPUT as root","Identify and scope the external tool that flushes v6 chains"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"if hasV6 := wgIface.Address().HasIPv6(); hasV6 {\n    if _, err := exec.Command(\"ip6tables\", \"-S\", \"NETBIRD-ACL-INPUT\").Output(); err != nil {\n        log.Warnf(\"v6 ACL chain missing; v6 pre-accept may fail\")\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := fm.AllowNetbird(); err != nil {\n    var merr *multierror.Error\n    if errors.As(err, &merr) {\n        for _, e := range merr.Errors {\n            if strings.Contains(e.Error(), \"v6 interface traffic\") {\n                log.Errorf(\"v6 overlay traffic may be dropped: %v\", e)\n            }\n        }\n    }\n}","preventionTips":["Ensure v6 chains exist before userspace filtering wraps the manager","Restart the agent to rebuild chains and retry the pre-accept rules","On v6-capable overlays, monitor ip6tables chain presence after external firewall jobs"],"tags":["iptables","ipv6","firewall","userspace","acl","netbird","go"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}