{"record":{"id":"c751cea5853bb778","repo":"netbirdio/netbird","slug":"init-ip6tables-w","errorCode":null,"errorMessage":"init ip6tables: %w","messagePattern":"init ip6tables: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/firewall/iptables/manager_linux.go","lineNumber":82,"sourceCode":"\n\tm.aclMgr, err = newAclManager(iptablesClient, wgIface)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"create acl manager: %w\", err)\n\t}\n\n\tif wgIface.Address().HasIPv6() {\n\t\tif err := m.createIPv6Components(wgIface, mtu); err != nil {\n\t\t\treturn nil, fmt.Errorf(\"create IPv6 firewall: %w\", err)\n\t\t}\n\t}\n\n\treturn m, nil\n}\n\nfunc (m *Manager) createIPv6Components(wgIface iFaceMapper, mtu uint16) error {\n\tip6Client, err := iptables.NewWithProtocol(iptables.ProtocolIPv6)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"init ip6tables: %w\", err)\n\t}\n\tm.ipv6Client = ip6Client\n\n\tm.router6, err = newRouter(ip6Client, wgIface, mtu)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"create v6 router: %w\", err)\n\t}\n\n\t// Share the same IP forwarding state with the v4 router, since\n\t// Forwarding refcounter is per-family but shared between v4 and v6 routers.\n\tm.router6.ipFwdState = m.router.ipFwdState\n\n\tm.aclMgr6, err = newAclManager(ip6Client, wgIface)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"create v6 acl manager: %w\", err)\n\t}\n\n\treturn nil","sourceCodeStart":64,"sourceCodeEnd":100,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/firewall/iptables/manager_linux.go#L64-L100","documentation":"iptables.NewWithProtocol(ProtocolIPv6) failed inside createIPv6Components: go-iptables could not find or execute a usable ip6tables binary (or its nft variant) or could not parse `ip6tables --version`. This runs only when the interface has an IPv6 address, so v4-only hosts never hit it, but any dual-stack host without the v6 binary fails manager creation.","triggerScenarios":"Interface has a v6 address but ip6tables is not installed or not in the daemon's PATH; ip6tables exists but is a broken symlink/wrapper; version output unparseable (nonstandard wrapper scripts).","commonSituations":"Images that install `iptables` but not `ip6tables`; service units with minimal PATH; custom busybox wrappers; nft-only systems missing ip6tables-nft.","solutions":["Install ip6tables alongside iptables in the image/host (e.g. `apk add ip6tables` or the iptables package's v6 component).","Fix the service PATH to include /usr/sbin, /sbin.","Verify with `ip6tables --version` under the daemon's user and environment.","If v6 is not actually needed, remove the v6 address from the NetBird interface to skip this path entirely."],"exampleFix":"# alpine image\nRUN apk add --no-cache iptables ip6tables ipset\n\n# debian image\nRUN apt-get update && apt-get install -y iptables ip6tables ipset","handlingStrategy":"validation","validationCode":"func verifyIp6tablesBinary() error {\n    p, err := exec.LookPath(\"ip6tables\")\n    if err != nil {\n        return fmt.Errorf(\"ip6tables not found (required when the interface has an IPv6 address): %w\", err)\n    }\n    if out, err := exec.Command(p, \"--version\").CombinedOutput(); err != nil {\n        return fmt.Errorf(\"ip6tables --version failed: %s: %w\", out, err)\n    }\n    return nil\n}\n\n// call before iptables.Create() when the overlay is dual-stack","typeGuard":null,"tryCatchPattern":"if _, err := iptablesMgr.Create(wgIface, mtu); err != nil {\n    if strings.Contains(err.Error(), \"init ip6tables\") {\n        // install the v6 binary or drop the interface's v6 address to skip the v6 path\n        log.Fatalf(\"ip6tables unavailable but interface is dual-stack: %v\", err)\n    }\n}","preventionTips":["Package ip6tables with iptables in all agent images (apk: ip6tables; deb: part of iptables).","Watch service PATH; ip6tables usually lives in /usr/sbin like iptables.","Decide dual-stack deliberately: if v6 is unused, keep it off the interface so the binary is never required.","Add a deployment preflight that runs `ip6tables --version` under the daemon's uid."],"tags":["go","linux","ip6tables","ipv6","environment","container","netbird"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}