{"record":{"id":"ee92bbb6b2582abb","repo":"netbirdio/netbird","slug":"reset-v6-router-w","errorCode":null,"errorMessage":"reset v6 router: %w","messagePattern":"reset v6 router: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"client/firewall/iptables/manager_linux.go","lineNumber":348,"sourceCode":"}\n\n// Reset firewall to the default state\nfunc (m *Manager) Close(stateManager *statemanager.Manager) error {\n\tm.mutex.Lock()\n\tdefer m.mutex.Unlock()\n\n\tvar merr *multierror.Error\n\n\tif err := m.cleanupNoTrackChain(); err != nil {\n\t\tmerr = multierror.Append(merr, fmt.Errorf(\"cleanup notrack chain: %w\", err))\n\t}\n\n\tif m.hasIPv6() {\n\t\tif err := m.aclMgr6.Reset(); err != nil {\n\t\t\tmerr = multierror.Append(merr, fmt.Errorf(\"reset v6 acl manager: %w\", err))\n\t\t}\n\t\tif err := m.router6.Reset(); err != nil {\n\t\t\tmerr = multierror.Append(merr, fmt.Errorf(\"reset v6 router: %w\", err))\n\t\t}\n\t}\n\n\tif err := m.aclMgr.Reset(); err != nil {\n\t\tmerr = multierror.Append(merr, fmt.Errorf(\"reset acl manager: %w\", err))\n\t}\n\tif err := m.router.Reset(); err != nil {\n\t\tmerr = multierror.Append(merr, fmt.Errorf(\"reset router: %w\", err))\n\t}\n\n\t// Appending to merr intentionally blocks DeleteState below so ShutdownState\n\t// stays persisted and the crash-recovery path retries firewalld cleanup.\n\tif err := firewalld.UntrustInterface(m.wgIface.Name()); err != nil {\n\t\tmerr = multierror.Append(merr, err)\n\t}\n\n\t// attempt to delete state only if all other operations succeeded\n\tif merr == nil {","sourceCodeStart":330,"sourceCodeEnd":366,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/firewall/iptables/manager_linux.go#L330-L366","documentation":"During Manager.Close, router6.Reset() failed - removing the v6 routing chains (NETBIRD-RT-NAT/FWD-IN/FWD-OUT/PRE/RDR/NAT-OUTPUT/MSSCLAMP), jump rules, and v6 ipsets created by the route manager. Accumulated into the multierror; subsequent v4 resets still run and DeleteState is blocked so the persisted state retries next start.","triggerScenarios":"Close with hasIPv6() true and a failing ip6tables/ipset delete in the v6 router teardown - typically rules or ipsets already removed externally, or ipset busy because another process references it.","commonSituations":"External ip6tables flush mid-shutdown; leftover ipsets with refcounts; repeated teardown after a partially failed earlier Close.","solutions":["Cycle the agent (start then stop) so the ShutdownState recovery path completes teardown","Check and clean manually: ip6tables-save | grep NETBIRD and ipset list","Look at the wrapped error in daemon logs to distinguish 'already gone' from a real ipset/ip6tables fault"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := mgr.Close(stateManager); err != nil {\n    log.Warnf(\"close incomplete (v6 router reset failed); persisted state retries next start: %v\", err)\n}","preventionTips":["Perform a clean start/stop cycle after any failed Close to trigger idempotent recovery","Watch for ipsets stuck with references when v6 router reset keeps failing","Do not run the agent stop path unprivileged"],"tags":["iptables","ipv6","firewall","routing","cleanup","netbird","go"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}