netbirdio/netbird · error

acl manager init: %w

Error message

acl manager init: %w

What it means

Error "acl manager init: %w" thrown in netbirdio/netbird.

Source

Thrown at client/firewall/nftables/manager_linux.go:195

func (m *Manager) initFirewall() (err error) {
	workTable, err := m.createWorkTable()
	if err != nil {
		return fmt.Errorf("create work table: %w", err)
	}

	defer func() {
		if err != nil {
			m.rollbackInit()
		}
	}()

	if err := m.router.init(workTable); err != nil {
		return fmt.Errorf("router init: %w", err)
	}

	if err := m.aclManager.init(workTable); err != nil {
		return fmt.Errorf("acl manager init: %w", err)
	}

	if m.hasIPv6() {
		if err := m.initIPv6(); err != nil {
			// Peer has a v6 address: v6 firewall MUST work or we risk fail-open.
			return fmt.Errorf("init IPv6 firewall (required because peer has IPv6 address): %w", err)
		}
	}

	if err := m.initNoTrackChains(workTable); err != nil {
		log.Warnf("raw priority chains not available, notrack rules will be disabled: %v", err)
	}

	return nil
}

// persistState saves the current interface state for potential recreation on restart.
// Unlike iptables, which requires tracking individual rules, nftables maintains

View on GitHub (pinned to 93e97f4bf1)

When it happens

Trigger: Thrown at client/firewall/nftables/manager_linux.go:195 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/1278fdd97f613881. Report an issue: GitHub.