{"record":{"id":"c927c79db533e1e4","repo":"netbirdio/netbird","slug":"create-v6-acl-manager-w","errorCode":null,"errorMessage":"create v6 acl manager: %w","messagePattern":"create v6 acl manager: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/firewall/iptables/manager_linux.go","lineNumber":97,"sourceCode":"func (m *Manager) createIPv6Components(wgIface iFaceMapper, mtu uint16) error {\n\tip6Client, err := iptables.NewWithProtocol(iptables.ProtocolIPv6)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"init ip6tables: %w\", err)\n\t}\n\tm.ipv6Client = ip6Client\n\n\tm.router6, err = newRouter(ip6Client, wgIface, mtu)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"create v6 router: %w\", err)\n\t}\n\n\t// Share the same IP forwarding state with the v4 router, since\n\t// Forwarding refcounter is per-family but shared between v4 and v6 routers.\n\tm.router6.ipFwdState = m.router.ipFwdState\n\n\tm.aclMgr6, err = newAclManager(ip6Client, wgIface)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"create v6 acl manager: %w\", err)\n\t}\n\n\treturn nil\n}\n\nfunc (m *Manager) hasIPv6() bool {\n\treturn m.ipv6Client != nil\n}\n\nfunc (m *Manager) Init(stateManager *statemanager.Manager) error {\n\tstate := &ShutdownState{\n\t\tInterfaceState: &InterfaceState{\n\t\t\tNameStr:   m.wgIface.Name(),\n\t\t\tWGAddress: m.wgIface.Address(),\n\t\t\tMTU:       m.router.mtu,\n\t\t},\n\t}\n\tstateManager.RegisterState(state)","sourceCodeStart":79,"sourceCodeEnd":115,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/firewall/iptables/manager_linux.go#L79-L115","documentation":"Raised while building the IPv6 half of the iptables firewall Manager: Manager.Create sees wgIface.Address().HasIPv6() and calls createIPv6Components, which constructs the ip6tables client, the v6 router, and finally the v6 aclManager via newAclManager(ip6Client, wgIface). The wrap carries whatever that constructor returns. In the current tree newAclManager only fills a struct (acl_linux.go:50-59) and always returns nil, so this specific wrap is defensive and effectively unreachable in stock code; upstream it surfaces as 'create IPv6 firewall: create v6 acl manager: ...'.","triggerScenarios":"Calling firewall.Create(wgIface, mtu) on a Linux host where the overlay interface address contains an IPv6 part, and newAclManager returning a non-nil error (only possible in forks/older versions where the constructor performs fallible work such as probing ipset support).","commonSituations":"Custom builds or forks that added validation to newAclManager; version drift between the manager and a vendored iptables package; ShutdownState.Cleanup at next startup (state_linux.go:76) also re-enters this path and logs the failure.","solutions":["Read the wrapped error for the real cause; the %w chain names the exact failing constructor","Verify ip6tables works as root: ip6tables -L on the same host","If IPv6 is not needed, run the peer with a v4-only WgAddr so Create skips createIPv6Components entirely","Compare your newAclManager against upstream if the tree is modified"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// v6 components are only built when the interface has a v6 address\nif wgIface.Address().HasIPv6() {\n    if _, err := exec.LookPath(\"ip6tables\"); err != nil {\n        log.Warnf(\"v6 address present but ip6tables missing: %v\", err)\n    }\n}","typeGuard":null,"tryCatchPattern":"mgr, err := iptables.Create(wgIface, mtu)\nif err != nil {\n    var v6Err *someConstructorError // inspect errors.Unwrap chain for 'create v6 acl manager'\n    if errors.As(err, &v6Err) || strings.Contains(err.Error(), \"create IPv6 firewall\") {\n        // fall back to a v4-only interface address and retry Create\n    }\n    return err\n}","preventionTips":["Ensure iptables and ip6tables are both installed before the daemon starts","Keep the overlay address family consistent with the rules you intend to program","Run the agent as root so constructor-time netfilter probes succeed"],"tags":["iptables","ipv6","firewall","initialization","netbird","go"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}