{"record":{"id":"b504a0cbcc11da4e","repo":"netbirdio/netbird","slug":"reset-acl-manager-w","errorCode":null,"errorMessage":"reset acl manager: %w","messagePattern":"reset acl manager: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"client/firewall/iptables/manager_linux.go","lineNumber":353,"sourceCode":"\tdefer m.mutex.Unlock()\n\n\tvar merr *multierror.Error\n\n\tif err := m.cleanupNoTrackChain(); err != nil {\n\t\tmerr = multierror.Append(merr, fmt.Errorf(\"cleanup notrack chain: %w\", err))\n\t}\n\n\tif m.hasIPv6() {\n\t\tif err := m.aclMgr6.Reset(); err != nil {\n\t\t\tmerr = multierror.Append(merr, fmt.Errorf(\"reset v6 acl manager: %w\", err))\n\t\t}\n\t\tif err := m.router6.Reset(); err != nil {\n\t\t\tmerr = multierror.Append(merr, fmt.Errorf(\"reset v6 router: %w\", err))\n\t\t}\n\t}\n\n\tif err := m.aclMgr.Reset(); err != nil {\n\t\tmerr = multierror.Append(merr, fmt.Errorf(\"reset acl manager: %w\", err))\n\t}\n\tif err := m.router.Reset(); err != nil {\n\t\tmerr = multierror.Append(merr, fmt.Errorf(\"reset router: %w\", err))\n\t}\n\n\t// Appending to merr intentionally blocks DeleteState below so ShutdownState\n\t// stays persisted and the crash-recovery path retries firewalld cleanup.\n\tif err := firewalld.UntrustInterface(m.wgIface.Name()); err != nil {\n\t\tmerr = multierror.Append(merr, err)\n\t}\n\n\t// attempt to delete state only if all other operations succeeded\n\tif merr == nil {\n\t\tif err := stateManager.DeleteState(&ShutdownState{}); err != nil {\n\t\t\tmerr = multierror.Append(merr, fmt.Errorf(\"delete state: %w\", err))\n\t\t}\n\t}\n","sourceCodeStart":335,"sourceCodeEnd":371,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/firewall/iptables/manager_linux.go#L335-L371","documentation":"During Manager.Close, the v4 aclMgr.Reset() failed - removing NETBIRD-ACL-INPUT, its jump rule from INPUT, optional entries, and v4 ipsets. It runs after the v6 resets and is likewise accumulated, never aborting the remaining v4 router reset or firewalld untrust. Blocked DeleteState keeps the shutdown state persisted for retry.","triggerScenarios":"Close where a v4 iptables or ipset delete errors: chain INPUT's jump already removed, ipset still referenced, permissions dropped before teardown.","commonSituations":"Prior crash-recovery cleanup already removed v4 chains; concurrent iptables rewrite; agent stopped without root.","solutions":["Re-run Close, or restart and stop the agent so next-start Cleanup retries","Confirm cleanliness with iptables -S INPUT | grep NETBIRD and ipset list","Remove leftover NETBIRD-ACL-INPUT chain by hand if immediate cleanup is required"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := mgr.Close(stateManager); err != nil {\n    var merr *multierror.Error\n    if errors.As(err, &merr) {\n        for _, e := range merr.Errors {\n            log.Debugf(\"firewall teardown partial: %v\", e)\n        }\n    }\n    // ShutdownState persists; next start re-runs Cleanup\n}","preventionTips":["Expect teardown of already-flushed chains to error; verify final state with iptables -S instead","Keep the state directory healthy so recovery can find the persisted rules","Avoid double-calling Close from different goroutines (it is mutex-guarded but wasteful)"],"tags":["iptables","firewall","acl","cleanup","netbird","go"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}