{"record":{"id":"febbaa4aebf2691d","repo":"netbirdio/netbird","slug":"remove-legacy-routing-rule-w","errorCode":null,"errorMessage":"remove legacy routing rule: %w","messagePattern":"remove legacy routing rule: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/firewall/iptables/router_linux.go","lineNumber":304,"sourceCode":"\tr.updateState()\n\n\treturn nil\n}\n\n// RemoveNatRule removes an iptables rule pair from forwarding and nat chains\nfunc (r *router) RemoveNatRule(pair firewall.RouterPair) error {\n\tif pair.Masquerade {\n\t\tif err := r.removeNatRule(pair); err != nil {\n\t\t\treturn fmt.Errorf(\"remove nat rule: %w\", err)\n\t\t}\n\n\t\tif err := r.removeNatRule(firewall.GetInversePair(pair)); err != nil {\n\t\t\treturn fmt.Errorf(\"remove inverse nat rule: %w\", err)\n\t\t}\n\t}\n\n\tif err := r.removeLegacyRouteRule(pair); err != nil {\n\t\treturn fmt.Errorf(\"remove legacy routing rule: %w\", err)\n\t}\n\n\tr.updateState()\n\n\treturn nil\n}\n\n// addLegacyRouteRule adds a legacy routing rule for mgmt servers pre route acls\nfunc (r *router) addLegacyRouteRule(pair firewall.RouterPair) error {\n\truleKey := firewall.GenKey(firewall.ForwardingFormat, pair)\n\n\tif err := r.removeLegacyRouteRule(pair); err != nil {\n\t\treturn err\n\t}\n\n\trule := []string{\"-s\", pair.Source.String(), \"-d\", pair.Destination.String(), \"-j\", routingFinalForwardJump}\n\tif err := r.iptablesClient.Append(tableFilter, chainRTFWDIN, rule...); err != nil {\n\t\treturn fmt.Errorf(\"add legacy forwarding rule %s -> %s: %v\", pair.Source, pair.Destination, err)","sourceCodeStart":286,"sourceCodeEnd":322,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/firewall/iptables/router_linux.go#L286-L322","documentation":"Returned by router.RemoveNatRule when removeLegacyRouteRule fails. Note this call is unconditional: it runs even when the router is not in legacy mode, but only acts if a legacy rule key exists in r.rules (i.e. a legacy ACCEPT rule was previously installed). The inner failures are the DeleteIfExists on NETBIRD-RT-FWD-IN (error 550) or the ipset counter decrement (error 551).","triggerScenarios":"Removing a NAT/routing pair on a peer that earlier ran in legacyManagement mode (old management) and has a stored legacy forwarding rule. Fails when the iptables delete errors or when decrementing the set refcount errors (e.g. set in use, already destroyed).","commonSituations":"Management upgrade mid-session: peer installed legacy rules, management updated to route-ACL version, then rule removal hits a chain or set mutated by the earlier state; unclean shutdown leaving r.rules and kernel state diverged.","solutions":["Check which inner error fired ('remove legacy forwarding rule' vs 'decrement ipset counter') and follow its fix","Verify NETBIRD-RT-FWD-IN contents: sudo iptables -S NETBIRD-RT-FWD-IN","Run RemoveAllLegacyRouteRules path (full disconnect) to sweep leftovers","Restart the agent to resynchronize in-memory rules with the kernel"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := r.removeLegacyRouteRule(pair); err != nil {\n\tlog.Warnf(\"legacy rule cleanup failed for %s -> %s: %v\", pair.Source, pair.Destination, err)\n\t// not fatal for the main path; sweep later via RemoveAllLegacyRouteRules\n}","preventionTips":["After management upgrades, run a full disconnect/reconnect to sweep legacy rules","Watch for the inner error class (iptables vs ipset) before choosing a fix","Keep r.rules and kernel state in sync by always tearing down through the agent"],"tags":["iptables","legacy","cleanup","linux","netbird"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}