netbirdio/netbird · error

add accept rules to external chains: %w

Error message

add accept rules to external chains: %w

What it means

Error "add accept rules to external chains: %w" thrown in netbirdio/netbird.

Source

Thrown at client/firewall/nftables/router_linux.go:1075

	}
	return nberrors.FormatErrorOrNil(merr)
}

// acceptForwardRules adds iif/oif rules in the filter table/forward chain to make sure
// that our traffic is not dropped by existing rules there.
// The existing FORWARD rules/policies decide outbound traffic towards our interface.
// In case the FORWARD policy is set to "drop", we add an established/related rule to allow return traffic for the inbound rule.
// This method also adds INPUT chain rules to allow traffic to the local interface.
func (r *router) acceptForwardRules() error {
	var merr *multierror.Error

	if err := r.acceptFilterTableRules(); err != nil {
		merr = multierror.Append(merr, err)
	}

	if err := r.acceptExternalChainsRules(); err != nil {
		merr = multierror.Append(merr, fmt.Errorf("add accept rules to external chains: %w", err))
	}

	return nberrors.FormatErrorOrNil(merr)
}

func (r *router) acceptFilterTableRules() error {
	if r.filterTable == nil {
		return nil
	}

	fw := "iptables"

	defer func() {
		log.Debugf("Used %s to add accept forward and input rules", fw)
	}()

	// Try iptables first and fallback to nftables if iptables is not available.
	// Use the correct protocol (iptables vs ip6tables) for the address family.

View on GitHub (pinned to 93e97f4bf1)

When it happens

Trigger: Thrown at client/firewall/nftables/router_linux.go:1075 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/bd0dd815085f2a6f. Report an issue: GitHub.