{"record":{"id":"dcd5149edca800a7","repo":"netbirdio/netbird","slug":"remove-windows-firewall-rule-w","errorCode":null,"errorMessage":"remove windows firewall rule: %w","messagePattern":"remove windows firewall rule: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"client/firewall/uspfilter/allow_netbird_windows.go","lineNumber":37,"sourceCode":"\tdeleteRule       action = \"delete\"\n\tfirewallRuleName        = \"Netbird\"\n)\n\n// Close cleans up the firewall manager by removing all rules and closing trackers\nfunc (m *Manager) Close(*statemanager.Manager) error {\n\tm.mutex.Lock()\n\tdefer m.mutex.Unlock()\n\n\tm.resetState()\n\n\tif !isWindowsFirewallReachable() {\n\t\treturn nil\n\t}\n\n\tvar merr *multierror.Error\n\tif isFirewallRuleActive(firewallRuleName) {\n\t\tif err := manageFirewallRule(firewallRuleName, deleteRule); err != nil {\n\t\t\tmerr = multierror.Append(merr, fmt.Errorf(\"remove windows firewall rule: %w\", err))\n\t\t}\n\t}\n\n\tif isFirewallRuleActive(firewallRuleName + \"-v6\") {\n\t\tif err := manageFirewallRule(firewallRuleName+\"-v6\", deleteRule); err != nil {\n\t\t\tmerr = multierror.Append(merr, fmt.Errorf(\"remove windows v6 firewall rule: %w\", err))\n\t\t}\n\t}\n\n\treturn nberrors.FormatErrorOrNil(merr)\n}\n\n// AllowNetbird allows netbird interface traffic\nfunc (m *Manager) AllowNetbird() error {\n\tif !isWindowsFirewallReachable() {\n\t\treturn nil\n\t}\n","sourceCodeStart":19,"sourceCodeEnd":55,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/firewall/uspfilter/allow_netbird_windows.go#L19-L55","documentation":"Appended to a multierror in the uspfilter manager's Windows cleanup (client/firewall/uspfilter/allow_netbird_windows.go:37) when 'netsh advfirewall firewall delete rule name=NetBird' returns a non-zero exit. manageFirewallRule runs netsh via cmd.Run(); exit codes cover access-denied (service not elevated), the Windows Firewall/Group Policy blocking rule changes, the rule name being reported by isFirewallRuleActive but undeletable, or netsh missing from PATH/System32.","triggerScenarios":"Manager Reset running in a process without administrator rights; Windows Defender Firewall service (MpsSvc/BFE) stopped or policy-locked between the isFirewallRuleActive check and the delete; rule name duplicated so netsh refuses; corrupted firewall store.","commonSituations":"Running the agent binary manually (non-elevated) instead of the installed service; Group Policy 'Prohibit notifications' or firewall-policy lockdown modes; Windows embedded/IoT images without the full firewall stack; anti-malware interfering with netsh.","solutions":["Run the agent service as LocalSystem/Administrator so netsh can modify firewall rules","Check Windows Firewall service health: 'sc query mpssvc' and 'sc query bfe', start them if stopped","Delete the rule manually with 'netsh advfirewall firewall delete rule name=\"<ruleName>\"' to surface the real netsh error text","If the firewall is intentionally locked by policy, accept the warning - the code already falls back to user-space filtering rules"],"exampleFix":"// before\nif err := manageFirewallRule(firewallRuleName, deleteRule); err != nil {\n    merr = multierror.Append(merr, fmt.Errorf(\"remove windows firewall rule: %w\", err))\n}\n// after - capture netsh stderr so the failure is diagnosable\nif err := manageFirewallRule(firewallRuleName, deleteRule); err != nil {\n    log.Warnf(\"netsh delete %s failed (likely elevation/policy): %v\", firewallRuleName, err)\n    merr = multierror.Append(merr, fmt.Errorf(\"remove windows firewall rule: %w\", err))\n}","handlingStrategy":"try-catch","validationCode":"// elevation check before touching netsh\nif !isElevated() {\n    log.Warn(\"skipping Windows firewall rule management: not elevated\")\n    return nil\n}\nif !isWindowsFirewallReachable() {\n    return nil\n}","typeGuard":"func isElevated() bool {\n    var sid *windows.SID\n    _ = windows.AllocateAndInitializeSid(&windows.SECURITY_NT_AUTHORITY, 2,\n        windows.SECURITY_BUILTIN_DOMAIN_RID, windows.DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0, 0, &sid)\n    defer windows.Free(sid)\n    token := windows.GetCurrentProcessToken()\n    member, _ := token.IsMember(sid)\n    return member\n}","tryCatchPattern":"if err := manager.Reset(nil); err != nil {\n    for _, e := range unwrapMulti(err) {\n        if strings.Contains(e.Error(), \"windows firewall rule\") {\n            log.Warnf(\"windows firewall rule left behind: %v\", e)\n            continue // user-space rules still torn down\n        }\n        return err\n    }\n    return nil\n}","preventionTips":["Run the NetBird service via the Windows service host (LocalSystem), not a bare shell","Capture netsh stderr in logs to diagnose policy/permission refusals","Delete leftover rules manually with netsh when a run fails; they are inert once the interface is gone"],"tags":["windows","firewall","netsh","cleanup"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}