hashicorp/nomad · error

failed to parse postrouting rule for alloc %s

Error message

failed to parse postrouting rule for alloc %s

What it means

forceCleanup matched the alloc's POSTROUTING rule but the regex ipRuleRe extracted an unexpected number of capture groups, meaning the rule text deviates from the expected CNI format; cleanup aborts rather than deleting a misparsed rule.

Source

Thrown at client/allocrunner/networking_cni.go:663

	matcher := fmt.Sprintf(commentFmt, allocID)
	var ruleToPurge string
	for _, rule := range rules {
		if strings.Contains(rule, matcher) {
			ruleToPurge = rule
			break
		}
	}

	// no rule found for our allocation, just give up
	if ruleToPurge == "" {
		c.logger.Info("iptables cleanup: did not find postrouting rule for alloc", "alloc_id", allocID)
		return nil
	}

	// re-create the rule we need to delete, as tokens
	subs := ipRuleRe.FindStringSubmatch(ruleToPurge)
	if len(subs) != 4 {
		return fmt.Errorf("failed to parse postrouting rule for alloc %s", allocID)
	}
	cidr := subs[1]
	id := subs[2]
	chainID := subs[3]
	toDel := []string{
		`-s`,
		cidr,
		`-m`,
		`comment`,
		`--comment`,
		`name: "nomad" id: "` + id + `"`,
		`-j`,
		chainID,
	}

	// remove the jump rule
	ok := true
	if err = ipt.Delete(natTable, postRoutingChain, toDel...); err != nil {

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Inspect the raw rule with iptables -t nat -S POSTROUTING
2. Check for an unexpected CNI plugin version writing a different comment format
3. Remove the rule/chain manually for the alloc ID

When it happens

Trigger: Thrown at client/allocrunner/networking_cni.go:663 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/9b5f17822b7ebbd8. Report an issue: GitHub.