{"record":{"id":"ea2a5fe721b9d490","repo":"netbirdio/netbird","slug":"received-error-w-while-adding-allowed-ip-to-pee","errorCode":null,"errorMessage":"received error \"%w\" while adding allowed Ip to peer on interface %s with settings: allowed ips %s","messagePattern":"received error \"%w\" while adding allowed Ip to peer on interface (.+?) with settings: allowed ips (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/iface/configurer/kernel_unix.go","lineNumber":170,"sourceCode":"\t}\n\n\tpeerKeyParsed, err := wgtypes.ParseKey(peerKey)\n\tif err != nil {\n\t\treturn err\n\t}\n\tpeer := wgtypes.PeerConfig{\n\t\tPublicKey:         peerKeyParsed,\n\t\tUpdateOnly:        true,\n\t\tReplaceAllowedIPs: false,\n\t\tAllowedIPs:        []net.IPNet{ipNet},\n\t}\n\n\tconfig := wgtypes.Config{\n\t\tPeers: []wgtypes.PeerConfig{peer},\n\t}\n\terr = c.configure(config)\n\tif err != nil {\n\t\treturn fmt.Errorf(`received error \"%w\" while adding allowed Ip to peer on interface %s with settings: allowed ips %s`, err, c.deviceName, allowedIP)\n\t}\n\treturn nil\n}\n\nfunc (c *KernelConfigurer) RemoveAllowedIP(peerKey string, allowedIP netip.Prefix) error {\n\tipNet := net.IPNet{\n\t\tIP:   allowedIP.Addr().AsSlice(),\n\t\tMask: net.CIDRMask(allowedIP.Bits(), allowedIP.Addr().BitLen()),\n\t}\n\n\tpeerKeyParsed, err := wgtypes.ParseKey(peerKey)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"parse peer key: %w\", err)\n\t}\n\n\texistingPeer, err := c.getPeer(c.deviceName, peerKey)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"get peer: %w\", err)","sourceCodeStart":152,"sourceCodeEnd":188,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/iface/configurer/kernel_unix.go#L152-L188","documentation":"Returned by KernelConfigurer.AddAllowedIP when the wgctrl/netlink call to attach an allowed IP to a peer fails. The peer config is built with UpdateOnly: true, so the kernel WireGuard module only updates a peer that already exists; patching a missing peer makes the kernel answer ENOENT, which surfaces inside this message. Other wrapped causes are a missing/renamed interface, an invalid prefix, or missing CAP_NET_ADMIN. The underlying netlink error text appears between the quotes.","triggerScenarios":"AddAllowedIP called for a peer that was never created with UpdatePeer (UpdateOnly:true + nonexistent peer => kernel ENOENT); c.deviceName interface deleted or renamed before the call; allowedIP prefix rejected by netlink validation; ConfigureDevice returning EPERM because the process lacks CAP_NET_ADMIN.","commonSituations":"Route manager attaching a network-route allowed IP before the peer config sync created the peer; interface torn down concurrently during a reconnect cycle; daemon running unprivileged in a container without NET_ADMIN; custom interface name mismatch between creation and config.","solutions":["Create the peer first with UpdatePeer, then call AddAllowedIP, since UpdateOnly:true requires the peer to exist","Verify the interface exists and is a WireGuard device: sudo wg show <deviceName> or ip link show <deviceName>","Run the daemon as root or grant CAP_NET_ADMIN (container: --cap-add=NET_ADMIN)","Log the wrapped netlink error to tell ENOENT (missing peer/interface) from EPERM (permissions)"],"exampleFix":"// before: peer not created yet, UpdateOnly:true makes this fail with ENOENT\nerr := cfg.AddAllowedIP(peerKey, prefix)\n\n// after: create the peer first, then attach the allowed IP\nif err := cfg.UpdatePeer(peerKey, []netip.Prefix{prefix}, 0, nil, nil); err != nil {\n\treturn err\n}\nerr = cfg.AddAllowedIP(peerKey, prefix)","handlingStrategy":"validation","validationCode":"// ensure the peer exists before attaching an allowed IP (UpdateOnly:true requires it)\nstats, err := kernelCfg.FullStats()\nif err != nil {\n\treturn err\n}\nexists := false\nfor _, p := range stats.Peers {\n\tif p.PublicKey == peerKey {\n\t\texists = true\n\t\tbreak\n\t}\n}\nif !exists {\n\t// create the peer first: cfg.UpdatePeer(peerKey, nil, 0, nil, nil)\n}","typeGuard":null,"tryCatchPattern":"if err := cfg.AddAllowedIP(peerKey, prefix); err != nil {\n\tif errors.Is(err, os.ErrNotExist) {\n\t\t// peer or interface missing: create peer / interface, then retry once\n\t}\n\treturn fmt.Errorf(\"add allowed ip %s: %w\", prefix, err)\n}","preventionTips":["Always create peers with UpdatePeer before AddAllowedIP, since UpdateOnly:true never creates","Keep interface creation and peer configuration in one code path so the device always exists first","Run the agent with CAP_NET_ADMIN so ConfigureDevice never fails on permissions","Log wrapped netlink errors to separate ENOENT from EPERM quickly"],"tags":["wireguard","wgctrl","netlink","kernel","go","networking"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}