netbirdio/netbird · error

add rule %s: %w

Error message

add rule %s: %w

What it means

Error "add rule %s: %w" thrown in netbirdio/netbird.

Source

Thrown at client/firewall/iptables/router_linux.go:840

	// Forward filtering rule, if fwd policy is DROP
	forwardRule := []string{
		"-o", r.wgIface.Name(),
		"-p", proto,
		"-d", rule.TranslatedAddress.String(),
		"-j", "ACCEPT",
	}
	forwardRule = append(forwardRule, applyPort("--dport", &rule.TranslatedPort)...)
	rules[ruleKey+fwdSuffix] = ruleInfo{
		table: tableFilter,
		chain: chainRTFWDOUT,
		rule:  forwardRule,
	}

	for key, ruleInfo := range rules {
		if err := r.iptablesClient.Append(ruleInfo.table, ruleInfo.chain, ruleInfo.rule...); err != nil {
			r.cleanupFailedDNATAdd(rules)
			return nil, fmt.Errorf("add rule %s: %w", key, err)
		}
		r.rules[key] = ruleInfo.rule
	}

	if err := r.ipFwdState.RequestForwarding(r.v6); err != nil {
		r.cleanupFailedDNATAdd(rules)
		return nil, fmt.Errorf("enable forwarding: %w", err)
	}

	r.updateState()
	return rule, nil
}

// cleanupFailedDNATAdd removes the bookkeeping written by a partially applied
// AddDNATRule before rolling back the kernel rules, so no entries remain that
// never got a forwarding refcount. rollbackRules re-adds entries it failed to
// remove from the kernel.
func (r *router) cleanupFailedDNATAdd(rules map[string]ruleInfo) {

View on GitHub (pinned to 93e97f4bf1)

When it happens

Trigger: Thrown at client/firewall/iptables/router_linux.go:840 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/ebae89033fe99506. Report an issue: GitHub.