netbirdio/netbird · error

create router: %w

Error message

create router: %w

What it means

Wraps newRouter's error during Manager creation. In the current source newRouter only allocates the router struct and a refcounter whose constructor cannot fail, returning nil error, so this wrap is effectively unreachable; it exists to future-proof constructor work. If it ever fires, it would indicate the v4 router's setup failed before init, i.e. an internal invariant break rather than an environment issue.

Source

Thrown at client/firewall/iptables/manager_linux.go:62

	Name() string
	Address() wgaddr.Address
}

// Create iptables firewall manager
func Create(wgIface iFaceMapper, mtu uint16) (*Manager, error) {
	iptablesClient, err := iptables.NewWithProtocol(iptables.ProtocolIPv4)
	if err != nil {
		return nil, fmt.Errorf("init iptables: %w", err)
	}

	m := &Manager{
		wgIface:    wgIface,
		ipv4Client: iptablesClient,
	}

	m.router, err = newRouter(iptablesClient, wgIface, mtu)
	if err != nil {
		return nil, fmt.Errorf("create router: %w", err)
	}

	m.aclMgr, err = newAclManager(iptablesClient, wgIface)
	if err != nil {
		return nil, fmt.Errorf("create acl manager: %w", err)
	}

	if wgIface.Address().HasIPv6() {
		if err := m.createIPv6Components(wgIface, mtu); err != nil {
			return nil, fmt.Errorf("create IPv6 firewall: %w", err)
		}
	}

	return m, nil
}

func (m *Manager) createIPv6Components(wgIface iFaceMapper, mtu uint16) error {
	ip6Client, err := iptables.NewWithProtocol(iptables.ProtocolIPv6)

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. If hit on a fork, look at newRouter's added fallible steps (iptables exec, ipset create) and fix the underlying privilege/module issue.
2. On stock builds, capture logs and verify binary/source version alignment; the error indicates code drift.
3. Ensure the standard prerequisites anyway: root and a working iptables binary.

// nothing to validate for stock newRouter (infallible); for forks, pre-check its fallible steps
if _, err := exec.LookPath("iptables"); err != nil {
    return fmt.Errorf("router construction will fail: %w", err)
}

if _, err := iptablesMgr.Create(wgIface, mtu); err != nil {
    if strings.Contains(err.Error(), "create router") {
        // stock code cannot produce this: verify binary/source alignment
        log.Errorf("unexpected router construction failure; rebuild from matching sources: %v", err)
    }
}

When it happens

Trigger: Not reachable with the present implementation (newRouter returns r, nil). Hypothetically, adding fallible work to newRouter (chain checks, ipset probing) would surface here on iptables/privilege failures.

Common situations: Seeing this error in logs implies either a modified/forked newRouter or a stale binary; treat it as a version skew between the compiled manager_linux.go and router_linux.go.

Related errors

• create acl manager: %w
• add IP to ipset: %w
• failed to check rule: %w
• rule already exists
• failed to delete rule: %s, %v: %w

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/53834cc8b39ddece. Report an issue: GitHub.