{"record":{"id":"c6c41d6145a99ee2","repo":"netbirdio/netbird","slug":"create-ipv6-firewall-w","errorCode":null,"errorMessage":"create IPv6 firewall: %w","messagePattern":"create IPv6 firewall: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/firewall/iptables/manager_linux.go","lineNumber":72,"sourceCode":"\n\tm := &Manager{\n\t\twgIface:    wgIface,\n\t\tipv4Client: iptablesClient,\n\t}\n\n\tm.router, err = newRouter(iptablesClient, wgIface, mtu)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"create router: %w\", err)\n\t}\n\n\tm.aclMgr, err = newAclManager(iptablesClient, wgIface)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"create acl manager: %w\", err)\n\t}\n\n\tif wgIface.Address().HasIPv6() {\n\t\tif err := m.createIPv6Components(wgIface, mtu); err != nil {\n\t\t\treturn nil, fmt.Errorf(\"create IPv6 firewall: %w\", err)\n\t\t}\n\t}\n\n\treturn m, nil\n}\n\nfunc (m *Manager) createIPv6Components(wgIface iFaceMapper, mtu uint16) error {\n\tip6Client, err := iptables.NewWithProtocol(iptables.ProtocolIPv6)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"init ip6tables: %w\", err)\n\t}\n\tm.ipv6Client = ip6Client\n\n\tm.router6, err = newRouter(ip6Client, wgIface, mtu)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"create v6 router: %w\", err)\n\t}\n","sourceCodeStart":54,"sourceCodeEnd":90,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/firewall/iptables/manager_linux.go#L54-L90","documentation":"Manager creation took the IPv6 branch (wgIface.Address().HasIPv6()) and createIPv6Components failed, wrapping the ip6tables client init, the v6 router, or the v6 ACL manager construction. In practice the error is the ip6tables binary being missing/unusable, or v6 chain/table operations failing because the kernel has IPv6 disabled (ipv6.disable=1) while the NetBird interface was given a v6 address, or missing ip6table_* modules.","triggerScenarios":"Interface address reports IPv6 but the host lacks ip6tables (common in minimal images that ship only v4 iptables); kernel booted with ipv6.disable=1 or blacklisted ipv6 module while the overlay got a v6 address; ip6table_filter/ip6table_mangle modules not loadable; non-root daemon.","commonSituations":"Dual-stack misconfiguration where management assigns v6 addresses to peers on v4-only hosts; slim containers; hardened kernels with CONFIG_IPV6=m but no module; hosts where /proc/net/if_inet6 is absent.","solutions":["If the host should be v4-only, stop assigning IPv6 to the NetBird interface (management setting / network range) so HasIPv6() is false.","If dual-stack is intended, install ip6tables and load ip6table_filter/ip6table_mangle; ensure /proc/net/if_inet6 exists (no ipv6.disable=1).","Run the agent as root so v6 table operations succeed.","Check `ip6tables -L` manually in the daemon's environment."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"func verifyV6FirewallReadiness(hasIPv6 bool) error {\n    if !hasIPv6 {\n        return nil\n    }\n    if _, err := os.Stat(\"/proc/net/if_inet6\"); err != nil {\n        return errors.New(\"interface has IPv6 but kernel IPv6 is disabled; remove the v6 address or enable IPv6\")\n    }\n    if _, err := exec.LookPath(\"ip6tables\"); err != nil {\n        return fmt.Errorf(\"ip6tables required for dual-stack: %w\", err)\n    }\n    if os.Geteuid() != 0 {\n        return errors.New(\"v6 firewall setup requires root\")\n    }\n    return nil\n}\n\n// call with wgIface.Address().HasIPv6() before iptables.Create()","typeGuard":"func ifaceHasIPv6(a wgaddr.Address) bool { return a.HasIPv6() }","tryCatchPattern":"if _, err := iptablesMgr.Create(wgIface, mtu); err != nil {\n    if strings.Contains(err.Error(), \"create IPv6 firewall\") {\n        // either install ip6tables/enable IPv6, or drop the v6 address so HasIPv6() is false\n        log.Errorf(\"v6 firewall init failed: %v; align IPv6 enablement with the interface config\", err)\n    }\n}","preventionTips":["Only assign IPv6 addresses to the NetBird interface on hosts with real kernel IPv6 support.","Install ip6tables whenever iptables is installed; they ship together in mainstream distros.","Never boot with ipv6.disable=1 on hosts expected to run dual-stack overlays.","Test `ip6tables -L` in the daemon environment as part of deployment checks."],"tags":["go","linux","ip6tables","ipv6","firewall","environment","netbird"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}