{"record":{"id":"fa23a16f905d89dd","repo":"netbirdio/netbird","slug":"remove-windows-v6-firewall-rule-w","errorCode":null,"errorMessage":"remove windows v6 firewall rule: %w","messagePattern":"remove windows v6 firewall rule: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"client/firewall/uspfilter/allow_netbird_windows.go","lineNumber":43,"sourceCode":"\tm.mutex.Lock()\n\tdefer m.mutex.Unlock()\n\n\tm.resetState()\n\n\tif !isWindowsFirewallReachable() {\n\t\treturn nil\n\t}\n\n\tvar merr *multierror.Error\n\tif isFirewallRuleActive(firewallRuleName) {\n\t\tif err := manageFirewallRule(firewallRuleName, deleteRule); err != nil {\n\t\t\tmerr = multierror.Append(merr, fmt.Errorf(\"remove windows firewall rule: %w\", err))\n\t\t}\n\t}\n\n\tif isFirewallRuleActive(firewallRuleName + \"-v6\") {\n\t\tif err := manageFirewallRule(firewallRuleName+\"-v6\", deleteRule); err != nil {\n\t\t\tmerr = multierror.Append(merr, fmt.Errorf(\"remove windows v6 firewall rule: %w\", err))\n\t\t}\n\t}\n\n\treturn nberrors.FormatErrorOrNil(merr)\n}\n\n// AllowNetbird allows netbird interface traffic\nfunc (m *Manager) AllowNetbird() error {\n\tif !isWindowsFirewallReachable() {\n\t\treturn nil\n\t}\n\n\tif !isFirewallRuleActive(firewallRuleName) {\n\t\tif err := manageFirewallRule(firewallRuleName,\n\t\t\taddRule,\n\t\t\t\"dir=in\",\n\t\t\t\"enable=yes\",\n\t\t\t\"action=allow\",","sourceCodeStart":25,"sourceCodeEnd":61,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/firewall/uspfilter/allow_netbird_windows.go#L25-L61","documentation":"Appended to the same multierror in allow_netbird_windows.go:43 when deleting the IPv6 variant rule ('<name>-v6') via netsh fails. Identical failure surface to the v4 rule (elevation, service state, policy), plus IPv6-specific cases: IPv6 networking support disabled on the host can make the v6 rule unqueryable or undeletable even though isFirewallRuleActive saw it.","triggerScenarios":"Non-elevated Reset; Windows Firewall service flapping between the show and delete calls; IPv6 stack disabled via registry/adapter settings after the rule was created; group policy locking per-profile rules including the v6 one.","commonSituations":"Hardened Windows images with IPv6 disabled; mismatched rule versions after an agent upgrade that renamed the v6 rule; security software blocking netsh mutations.","solutions":["Run elevated and verify with 'netsh advfirewall firewall show rule name=<name>-v6' then delete manually to see the true error","Ensure IPv6 is enabled on the host if the v6 rule must be managed","If IPv6 is intentionally disabled, treat the v6 deletion failure as benign - the rule is inert without an IPv6 stack","Retry Reset once after firewall services stabilize; the multierror already keeps the v4 result independent"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"if !isWindowsFirewallReachable() {\n    return nil\n}\nif !ipv6EnabledOnHost() {\n    // v6 rule is inert without the IPv6 stack\n    return nil\n}","typeGuard":"func ipv6EnabledOnHost() bool {\n    ifaces, err := net.Interfaces()\n    if err != nil {\n        return false\n    }\n    for _, i := range ifaces {\n        addrs, err := i.Addrs()\n        if err != nil {\n            continue\n        }\n        for _, a := range addrs {\n            if ipnet, ok := a.(*net.IPNet); ok && ipnet.IP.To16() != nil && ipnet.IP.To4() == nil {\n                return true\n            }\n        }\n    }\n    return false\n}","tryCatchPattern":"if err := manager.Reset(nil); err != nil {\n    if strings.Contains(err.Error(), \"v6 firewall rule\") {\n        log.Warn(\"v6 firewall rule left behind; IPv6 disabled or policy-locked host\")\n        return nil\n    }\n    return err\n}","preventionTips":["Keep v4 and v6 rule teardown independent (the multierror already isolates them)","Verify the Windows Firewall service is running before installers/agents mutate rules","After agent uninstall, run both netsh delete commands once to catch leftovers"],"tags":["windows","firewall","netsh","ipv6","cleanup"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}