{"record":{"id":"ae099a1d8e26768c","repo":"netbirdio/netbird","slug":"clear-and-delete-chain-s-in-table-s-w","errorCode":null,"errorMessage":"clear and delete chain %s in table %s: %w","messagePattern":"clear and delete chain (.+?) in table (.+?): %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/firewall/iptables/router_linux.go","lineNumber":431,"sourceCode":"\n\tfor _, chainInfo := range []struct {\n\t\tchain string\n\t\ttable string\n\t}{\n\t\t{chainRTFWDIN, tableFilter},\n\t\t{chainRTFWDOUT, tableFilter},\n\t\t{chainRTPRE, tableMangle},\n\t\t{chainRTNAT, tableNat},\n\t\t{chainRTRDR, tableNat},\n\t\t{chainNATOutput, tableNat},\n\t\t{chainRTMSSCLAMP, tableMangle},\n\t} {\n\t\tok, err := r.iptablesClient.ChainExists(chainInfo.table, chainInfo.chain)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"check chain %s in table %s: %w\", chainInfo.chain, chainInfo.table, err)\n\t\t} else if ok {\n\t\t\tif err = r.iptablesClient.ClearAndDeleteChain(chainInfo.table, chainInfo.chain); err != nil {\n\t\t\t\treturn fmt.Errorf(\"clear and delete chain %s in table %s: %w\", chainInfo.chain, chainInfo.table, err)\n\t\t\t}\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc (r *router) createContainers() error {\n\tfor _, chainInfo := range []struct {\n\t\tchain string\n\t\ttable string\n\t}{\n\t\t{chainRTFWDIN, tableFilter},\n\t\t{chainRTFWDOUT, tableFilter},\n\t\t{chainRTPRE, tableMangle},\n\t\t{chainRTNAT, tableNat},\n\t\t{chainRTRDR, tableNat},\n\t\t{chainRTMSSCLAMP, tableMangle},","sourceCodeStart":413,"sourceCodeEnd":449,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/firewall/iptables/router_linux.go#L413-L449","documentation":"Returned by router.cleanUpDefaultForwardRules when iptablesClient.ClearAndDeleteChain fails for an existing NetBird chain (flush + delete). The comment in the source names the classic cause: deleting a chain that is still referenced fails with 'device or resource busy'. The code removes its own jump rules first precisely to avoid this, so a failure means some other reference remains.","triggerScenarios":"Init cleanup or Reset flushing one of the seven custom chains while something still jumps to it: a rule added by another tool or an older netbird version, a second NETBIRD chain referencing it, or a concurrent agent re-adding jumps between the jump cleanup and the chain delete.","commonSituations":"Upgrade from an older agent layout whose jump specs differ (so DeleteIfExists did not match); leftover hand-written rules targeting NETBIRD-* chains; two agents racing on one host.","solutions":["List references: sudo iptables-save | grep -e '-j NETBIRD-' and delete the foreign/stale jumps","Retry cleanup once references are gone","Ensure a single netbird instance runs per host","If busy persists, flush manually: sudo iptables -F <chain> && sudo iptables -X <chain> per table"],"exampleFix":"# manual recovery when agent cleanup keeps failing\nsudo iptables-save | grep -- '-j NETBIRD-'\nsudo iptables -t nat -D OUTPUT -j NETBIRD-NAT-OUTPUT 2>/dev/null\nsudo iptables -F NETBIRD-RT-NAT && sudo iptables -X NETBIRD-RT-NAT","handlingStrategy":"validation","validationCode":"// before deleting, confirm nothing jumps into the chain\nout, _ := exec.Command(\"iptables-save\").Output()\nfor _, line := range strings.Split(string(out), \"\\n\") {\n\tif strings.Contains(line, \"-j \"+chain) {\n\t\treturn fmt.Errorf(\"chain %s still referenced: %s\", chain, line)\n\t}\n}","typeGuard":null,"tryCatchPattern":"if err = r.iptablesClient.ClearAndDeleteChain(chainInfo.table, chainInfo.chain); err != nil {\n\tif strings.Contains(err.Error(), \"busy\") || strings.Contains(err.Error(), \"Resource busy\") {\n\t\t// sweep foreign jump rules, then retry this chain once\n\t}\n\treturn fmt.Errorf(\"clear and delete chain %s in table %s: %w\", chainInfo.chain, chainInfo.table, err)\n}","preventionTips":["Always remove jump rules from built-in chains before deleting custom chains","Search 'iptables-save | grep -e \"-j NETBIRD-\"' after upgrade migrations","Keep one agent instance; concurrent re-adds of jumps cause busy deletes"],"tags":["iptables","cleanup","chains","linux","netbird"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}