cilium/cilium · error

inserting ipv4 from ingress proxy routing rule %v: %w

Error message

inserting ipv4 from ingress proxy routing rule %v: %w

What it means

Installing the IPv4 'from ingress proxy' netlink routing rule failed. installFromProxyRoutesIPv4 calls route.ReplaceRule(fromIngressProxyRule) to create/replace the rule that sends traffic from the ingress proxy into the routing table for Cilium; a non-nil netlink error is wrapped and returned. Raised only when the fromIngressProxy flag is enabled.

Source

Thrown at pkg/proxy/routes.go:280

		AdminDistance: reconciler.AdminDistanceDefault,

		Device: device,
		Scope:  reconciler.Scope(netlink.SCOPE_LINK),
	}
	fromProxyDefaultRoute4 := reconciler.DesiredRoute{
		Owner:         routeOwner,
		Table:         linux_defaults.RouteTableFromProxy,
		Prefix:        netip.MustParsePrefix("0.0.0.0/0"),
		AdminDistance: reconciler.AdminDistanceDefault,

		Nexthop: ipv4,
		Device:  device,
		MTU:     uint32(mtu),
	}

	if fromIngressProxy {
		if err := route.ReplaceRule(fromIngressProxyRule); err != nil {
			return fmt.Errorf("inserting ipv4 from ingress proxy routing rule %v: %w", fromIngressProxyRule, err)
		}
	}
	if fromEgressProxy {
		if err := route.ReplaceRule(fromEgressProxyRule); err != nil {
			return fmt.Errorf("inserting ipv4 from egress proxy routing rule %v: %w", fromEgressProxyRule, err)
		}
	}
	if err := routeManager.UpsertRouteWait(fromProxyToCiliumHostRoute4); err != nil {
		return fmt.Errorf("inserting ipv4 from proxy to cilium_host route %v: %w", fromProxyToCiliumHostRoute4, err)
	}
	if err := routeManager.UpsertRouteWait(fromProxyDefaultRoute4); err != nil {
		return fmt.Errorf("inserting ipv4 from proxy default route %v: %w", fromProxyDefaultRoute4, err)
	}

	return nil
}

// removeFromProxyRulesIPv4 ensures routes and rules for traffic from the proxy are removed.

View on GitHub (pinned to ac7b90affa)

Solutions

1. Inspect 'ip rule show' for conflicting rules at the same priority as fromIngressProxyRule
2. Ensure the agent has CAP_NET_ADMIN and can open netlink sockets in the host netns
3. Check for other network agents (kube-proxy modes, other CNIs) contending for ip rules
4. Restart the agent to re-run ReinstallRoutingRules once netlink state is clean

Example fix

// before
# conflicting rule at same priority
32765: from all fwmark 0xA00/0xF00 lookup 2005
// after
# remove conflicting rule, then reinstall
ip rule del priority 32765 fwmark 0xA00/0xF00 lookup 2005
cilium-agent: restart to re-run ReinstallRoutingRules

// preflight
out, _ := exec.Command("ip", "rule", "show").Output()
if strings.Contains(string(out), fmt.Sprintf("%d:", fromIngressProxyRule.Priority)) {
  return errors.New("conflicting ip rule priority already installed")
}

if err := ReinstallRoutingRules(...); err != nil {
  var ctxErr *fmt.Errorf // wrapped with %w
  if errors.Is(err, unix.EPERM) {
    log.Error("cannot insert ipv4 ingress proxy rule: missing NET_ADMIN")
  }
  return err
}

When it happens

Trigger: ReinstallRoutingRules -> installFromProxyRoutesIPv4 with fromIngressProxy=true and route.ReplaceRule(fromIngressProxyRule) returning an error (rule priority conflicts, table mismatch, permission failure).

Common situations: Hosts where another CNI or routing daemon already owns rule priorities; agents lacking CAP_NET_ADMIN; iprule tables exhausted or corrupted after repeated restarts.

Related errors

• failed to apply initial sync (no encapsulation): delete ipv4
• replace local ipv4 rule: %w
• remove default local ipv4 rule: %w
• inserting ipv4 from egress proxy routing rule %v: %w
• inserting ipv4 from proxy to cilium_host route %v: %w

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/4413a85fe154306a. Report an issue: GitHub.