netbirdio/netbird · error

create acl manager: %w

Error message

create acl manager: %w

What it means

Wraps newAclManager during Manager creation. newAclManager in the current source is a pure struct initializer (maps, ipsetStore, v6 flag from the client's protocol) and always returns a nil error, so this wrap cannot fire on stock builds. Its real work, cleanChains and createDefaultChains, happens later in init() with its own wrapped errors.

Source

Thrown at client/firewall/iptables/manager_linux.go:67

func Create(wgIface iFaceMapper, mtu uint16) (*Manager, error) {
	iptablesClient, err := iptables.NewWithProtocol(iptables.ProtocolIPv4)
	if err != nil {
		return nil, fmt.Errorf("init iptables: %w", err)
	}

	m := &Manager{
		wgIface:    wgIface,
		ipv4Client: iptablesClient,
	}

	m.router, err = newRouter(iptablesClient, wgIface, mtu)
	if err != nil {
		return nil, fmt.Errorf("create router: %w", err)
	}

	m.aclMgr, err = newAclManager(iptablesClient, wgIface)
	if err != nil {
		return nil, fmt.Errorf("create acl manager: %w", err)
	}

	if wgIface.Address().HasIPv6() {
		if err := m.createIPv6Components(wgIface, mtu); err != nil {
			return nil, fmt.Errorf("create IPv6 firewall: %w", err)
		}
	}

	return m, nil
}

func (m *Manager) createIPv6Components(wgIface iFaceMapper, mtu uint16) error {
	ip6Client, err := iptables.NewWithProtocol(iptables.ProtocolIPv6)
	if err != nil {
		return fmt.Errorf("init ip6tables: %w", err)
	}
	m.ipv6Client = ip6Client

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. Verify you are running an unmodified, consistently built binary (the wrap and the constructor must match).
2. If on a fork, move any fallible setup out of the constructor into init() where errors are meaningfully wrapped, or fix the underlying iptables/privilege cause.
3. Check root and iptables availability since those gate the surrounding creation steps.

// newAclManager is a pure initializer on stock builds; nothing to pre-validate.
// For forks that add fallible constructor work, pre-check iptables availability:
if _, err := exec.LookPath("iptables"); err != nil {
    return err
}

if _, err := iptablesMgr.Create(wgIface, mtu); err != nil {
    if strings.Contains(err.Error(), "create acl manager") {
        // stock code cannot produce this: suspect version skew or a fork
        log.Errorf("unexpected acl manager construction failure: %v", err)
    }
}

When it happens

Trigger: Unreachable in the present implementation (newAclManager returns nil error). Would only fire on forks/older trees where the constructor performed fallible setup such as chain creation.

Common situations: Encountering it indicates a modified build or version mismatch between compiled files; the analogous real failures at this stage come from iptables.NewWithProtocol (error 494) or later init() errors.

Related errors

• create router: %w
• add IP to ipset: %w
• failed to check rule: %w
• rule already exists
• failed to delete rule: %s, %v: %w

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/e53b8522ea2b3601. Report an issue: GitHub.