netbirdio/netbird · error

create chain %s in table %s: %w

Error message

create chain %s in table %s: %w

What it means

Returned by router.createContainers when insertEstablishedRule(NETBIRD-RT-FWD-IN) fails. insertEstablishedRule Inserts '-m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT' at position 1 of the just-created filter chain so existing flows bypass route ACL evaluation. Failure means the iptables Insert rejected the spec.

Source

Thrown at client/firewall/iptables/router_linux.go:458

	for _, chainInfo := range []struct {
		chain string
		table string
	}{
		{chainRTFWDIN, tableFilter},
		{chainRTFWDOUT, tableFilter},
		{chainRTPRE, tableMangle},
		{chainRTNAT, tableNat},
		{chainRTRDR, tableNat},
		{chainRTMSSCLAMP, tableMangle},
	} {
		// Fallback: clear chains that survived an unclean shutdown.
		if ok, _ := r.iptablesClient.ChainExists(chainInfo.table, chainInfo.chain); ok {
			if err := r.iptablesClient.ClearAndDeleteChain(chainInfo.table, chainInfo.chain); err != nil {
				log.Warnf("clear stale chain %s in %s: %v", chainInfo.chain, chainInfo.table, err)
			}
		}
		if err := r.iptablesClient.NewChain(chainInfo.table, chainInfo.chain); err != nil {
			return fmt.Errorf("create chain %s in table %s: %w", chainInfo.chain, chainInfo.table, err)
		}
	}

	if err := r.insertEstablishedRule(chainRTFWDIN); err != nil {
		return fmt.Errorf("insert established rule: %w", err)
	}

	if err := r.insertEstablishedRule(chainRTFWDOUT); err != nil {
		return fmt.Errorf("insert established rule: %w", err)
	}

	if err := r.addPostroutingRules(); err != nil {
		return fmt.Errorf("add static nat rules: %w", err)
	}

	if err := r.addJumpRules(); err != nil {
		return fmt.Errorf("add jump rules: %w", err)
	}

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. Load the module: modprobe xt_conntrack (check CONFIG_NETFILTER_XT_MATCH_CONNTRACK)
2. Test manually: sudo iptables -I NETBIRD-RT-FWD-IN 1 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
3. Check for concurrent netbird instances deleting chains during init
4. Retry agent start once the module is loaded

# preflight conntrack match support
sudo iptables -C FORWARD -m conntrack --ctstate ESTABLISHED -j ACCEPT 2>&1 || modprobe xt_conntrack

When it happens

Trigger: During init/createContainers right after NewChain succeeded on NETBIRD-RT-FWD-IN. Fails when xt_conntrack module/kernel CONFIG is missing ('No such file or directory'), the chain disappeared between create and insert, or the xtables lock is contended.

Common situations: Minimal/embedded kernels and slim containers without conntrack support; hosts where another agent instance deleted chains mid-init; conntrack table exhaustion is a different error but worth checking under load.

Related errors

• insert established rule: %w
• add IP to ipset: %w
• failed to check rule: %w
• rule already exists
• failed to delete rule: %s, %v: %w

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/2d1a16172e2e3d54. Report an issue: GitHub.