hashicorp/nomad · error

failed to list iptables chains: %v

Error message

failed to list iptables chains: %v

What it means

ensureChain called ipt.ListChains to check whether the Nomad admin chain exists and the listing operation failed (iptables missing, permission denied, or netfilter error), so admin chain setup for bridge networking cannot proceed.

Source

Thrown at client/allocrunner/networking_iptables.go:71

// ensureChainRule ensures our admin chain exists and contains a rule to accept
// traffic to the bridge network
func ensureChainRule(ipt IPTablesChain, bridgeName, subnet string) error {
	if err := ensureChain(ipt, "filter", cniAdminChainName); err != nil {
		return err
	}
	rule := generateAdminChainRule(bridgeName, subnet)
	if err := appendChainRule(ipt, cniAdminChainName, rule); err != nil {
		return err
	}
	return nil
}

// ensureChain ensures that the given chain exists, creating it if missing
func ensureChain(ipt IPTablesChain, table, chain string) error {
	chains, err := ipt.ListChains(table)
	if err != nil {
		return fmt.Errorf("failed to list iptables chains: %v", err)
	}
	if slices.Contains(chains, chain) {
		return nil
	}

	err = ipt.NewChain(table, chain)

	// if err is for chain already existing return as it is possible another
	// goroutine created it first
	if e, ok := err.(*iptables.Error); ok && e.ExitStatus() == 1 {
		return nil
	}

	return err
}

// appendChainRule adds the given rule to the chain
func appendChainRule(ipt IPTablesChain, chain string, rule []string) error {

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Ensure iptables is installed and executable by the Nomad client
2. Verify root/CAP_NET_ADMIN capability for iptables operations
3. Check kernel netfilter module availability (modprobe ip_tables)

When it happens

Trigger: Thrown at client/allocrunner/networking_iptables.go:71 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/ff28ef7f3bdc7777. Report an issue: GitHub.