netbirdio/netbird · error

create v6 default allow rules: %w

Error message

create v6 default allow rules: %w

What it means

Error "create v6 default allow rules: %w" thrown in netbirdio/netbird.

Source

Thrown at client/firewall/nftables/manager_linux.go:453

// This is called when USPFilter wraps the native firewall, adding blanket accept
// rules so that packet filtering is handled in userspace instead of by netfilter.
//
// TODO: In USP mode this only adds ACCEPT to the netbird table's own chains,
// which doesn't override DROP rules in external tables (e.g. firewalld).
// Should add passthrough rules to external chains (like the native mode router's
// addExternalChainsRules does) for both the netbird table family and inet tables.
// The netbird table itself is fine (routing chains already exist there), but
// non-netbird tables with INPUT/FORWARD hooks can still DROP our WG traffic.
func (m *Manager) AllowNetbird() error {
	m.mutex.Lock()
	defer m.mutex.Unlock()

	if err := m.aclManager.createDefaultAllowRules(); err != nil {
		return fmt.Errorf("create default allow rules: %w", err)
	}
	if m.hasIPv6() {
		if err := m.aclManager6.createDefaultAllowRules(); err != nil {
			return fmt.Errorf("create v6 default allow rules: %w", err)
		}
	}
	if err := m.rConn.Flush(); err != nil {
		return fmt.Errorf("flush allow input netbird rules: %w", err)
	}

	if err := firewalld.TrustInterface(m.wgIface.Name()); err != nil {
		log.Warnf("failed to trust interface in firewalld: %v", err)
	}

	return nil
}

// SetLegacyManagement sets the route manager to use legacy management
func (m *Manager) SetLegacyManagement(isLegacy bool) error {
	if err := firewall.SetLegacyManagement(m.router, isLegacy); err != nil {
		return err
	}

View on GitHub (pinned to 93e97f4bf1)

When it happens

Trigger: Thrown at client/firewall/nftables/manager_linux.go:453 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/f08e7c4d41285e53. Report an issue: GitHub.