{"record":{"id":"f3149e7032f3297b","repo":"netbirdio/netbird","slug":"remove-v6-nat-rule-w-f3149e","errorCode":null,"errorMessage":"remove v6 NAT rule: %w","messagePattern":"remove v6 NAT rule: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/firewall/nftables/manager_linux.go","lineNumber":427,"sourceCode":"\tdefer m.mutex.Unlock()\n\n\tif pair.Destination.IsPrefix() && pair.Destination.Prefix.Addr().Is6() {\n\t\tif !m.hasIPv6() {\n\t\t\treturn nil\n\t\t}\n\t\treturn m.router6.RemoveNatRule(pair)\n\t}\n\n\tvar merr *multierror.Error\n\n\tif err := m.router.RemoveNatRule(pair); err != nil {\n\t\tmerr = multierror.Append(merr, fmt.Errorf(\"remove v4 NAT rule: %w\", err))\n\t}\n\n\tif m.hasIPv6() && pair.Dynamic {\n\t\tv6Pair := firewall.ToV6NatPair(pair)\n\t\tif err := m.router6.RemoveNatRule(v6Pair); err != nil {\n\t\t\tmerr = multierror.Append(merr, fmt.Errorf(\"remove v6 NAT rule: %w\", err))\n\t\t}\n\t}\n\n\treturn nberrors.FormatErrorOrNil(merr)\n}\n\n// AllowNetbird allows netbird interface traffic.\n// This is called when USPFilter wraps the native firewall, adding blanket accept\n// rules so that packet filtering is handled in userspace instead of by netfilter.\n//\n// TODO: In USP mode this only adds ACCEPT to the netbird table's own chains,\n// which doesn't override DROP rules in external tables (e.g. firewalld).\n// Should add passthrough rules to external chains (like the native mode router's\n// addExternalChainsRules does) for both the netbird table family and inet tables.\n// The netbird table itself is fine (routing chains already exist there), but\n// non-netbird tables with INPUT/FORWARD hooks can still DROP our WG traffic.\nfunc (m *Manager) AllowNetbird() error {\n\tm.mutex.Lock()","sourceCodeStart":409,"sourceCodeEnd":445,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/firewall/nftables/manager_linux.go#L409-L445","documentation":"Error \"remove v6 NAT rule: %w\" thrown in netbirdio/netbird.","triggerScenarios":"Thrown at client/firewall/nftables/manager_linux.go:427 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}