netbirdio/netbird · error

create v6 router: %w

Error message

create v6 router: %w

What it means

Inside createIPv6Components, newRouter for the ip6tables client failed and is wrapped as 'create v6 router'. The current newRouter implementation performs no fallible work (struct allocation plus a refcounter) and returns nil, so on stock code this wrap is unreachable; hitting it implies a fork or binary/source skew. The realistic v6 creation failures on stock builds are errors 498 (ip6tables init) and 500-series init errors instead.

Source

Thrown at client/firewall/iptables/manager_linux.go:88

	if wgIface.Address().HasIPv6() {
		if err := m.createIPv6Components(wgIface, mtu); err != nil {
			return nil, fmt.Errorf("create IPv6 firewall: %w", err)
		}
	}

	return m, nil
}

func (m *Manager) createIPv6Components(wgIface iFaceMapper, mtu uint16) error {
	ip6Client, err := iptables.NewWithProtocol(iptables.ProtocolIPv6)
	if err != nil {
		return fmt.Errorf("init ip6tables: %w", err)
	}
	m.ipv6Client = ip6Client

	m.router6, err = newRouter(ip6Client, wgIface, mtu)
	if err != nil {
		return fmt.Errorf("create v6 router: %w", err)
	}

	// Share the same IP forwarding state with the v4 router, since
	// Forwarding refcounter is per-family but shared between v4 and v6 routers.
	m.router6.ipFwdState = m.router.ipFwdState

	m.aclMgr6, err = newAclManager(ip6Client, wgIface)
	if err != nil {
		return fmt.Errorf("create v6 acl manager: %w", err)
	}

	return nil
}

func (m *Manager) hasIPv6() bool {
	return m.ipv6Client != nil
}

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. Confirm the binary matches the source tree (rebuild); on stock code this error cannot occur.
2. On forks, inspect what newRouter now does and fix the underlying ip6tables privilege/module issue.
3. Ensure IPv6 kernel support and root regardless, since the surrounding v6 path requires both.

// stock newRouter cannot fail; for forks with fallible v6 construction, pre-check:
if _, err := exec.LookPath("ip6tables"); err != nil {
    return fmt.Errorf("v6 router construction prerequisites missing: %w", err)
}

if _, err := iptablesMgr.Create(wgIface, mtu); err != nil {
    if strings.Contains(err.Error(), "create v6 router") {
        // unexpected on stock builds: verify source/binary alignment and v6 prerequisites
        log.Errorf("v6 router construction failed: %v", err)
    }
}

When it happens

Trigger: Not reachable with the present newRouter (returns nil error). On modified builds, any fallible work added to v6 router construction (chain existence checks, ipset probing over ip6tables) failing on privileges or missing kernel v6 tables would land here.

Common situations: Version mismatch between compiled manager_linux.go and router_linux.go; custom forks that moved init-time work into the constructor.

Related errors

• create IPv6 firewall: %w
• create router: %w
• create acl manager: %w
• init ip6tables: %w
• add IP to ipset: %w

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/91f71c08e167d3a3. Report an issue: GitHub.