netbirdio/netbird · error

add iptables input rule: %v

Error message

add iptables input rule: %v

What it means

Error "add iptables input rule: %v" thrown in netbirdio/netbird.

Source

Thrown at client/firewall/nftables/router_linux.go:1123

		return r.acceptFilterRulesNftables(r.filterTable)
	}
	return nil
}

func (r *router) acceptFilterRulesIptables(ipt *iptables.IPTables) error {
	var merr *multierror.Error

	for _, rule := range r.getAcceptForwardRules() {
		if err := ipt.Insert("filter", chainNameForward, 1, rule...); err != nil {
			merr = multierror.Append(merr, fmt.Errorf("add iptables forward rule: %v", err))
		} else {
			log.Debugf("added iptables forward rule: %v", rule)
		}
	}

	inputRule := r.getAcceptInputRule()
	if err := ipt.Insert("filter", chainNameInput, 1, inputRule...); err != nil {
		merr = multierror.Append(merr, fmt.Errorf("add iptables input rule: %v", err))
	} else {
		log.Debugf("added iptables input rule: %v", inputRule)
	}

	return nberrors.FormatErrorOrNil(merr)
}

func (r *router) getAcceptForwardRules() [][]string {
	intf := r.wgIface.Name()
	return [][]string{
		{"-i", intf, "-j", "ACCEPT"},
		{"-o", intf, "-m", "conntrack", "--ctstate", "RELATED,ESTABLISHED", "-j", "ACCEPT"},
	}
}

func (r *router) getAcceptInputRule() []string {
	return []string{"-i", r.wgIface.Name(), "-j", "ACCEPT"}
}

View on GitHub (pinned to 93e97f4bf1)

When it happens

Trigger: Thrown at client/firewall/nftables/router_linux.go:1123 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/42388cfbb1913ffb. Report an issue: GitHub.