netbirdio/netbird · info

creating default subnet: %w

Error message

creating default subnet: %w

What it means

Returned when tcpip.NewSubnet rejects the default IPv4 catch-all 0.0.0.0/0. NewSubnet only fails when the mask is non-contiguous (not a valid prefix mask), which cannot happen with the literal 0,0,0,0 mask hardcoded here. This is a defensive check around a practically unreachable error in gVisor's subnet API.

Source

Thrown at client/firewall/uspfilter/forwarder/forwarder.go:117

	if v6 := iface.Address().IPv6; v6.IsValid() {
		v6Addr := tcpip.ProtocolAddress{
			Protocol: ipv6.ProtocolNumber,
			AddressWithPrefix: tcpip.AddressWithPrefix{
				Address:   tcpip.AddrFrom16(v6.As16()),
				PrefixLen: iface.Address().IPv6Net.Bits(),
			},
		}
		if err := s.AddProtocolAddress(nicID, v6Addr, stack.AddressProperties{}); err != nil {
			return nil, fmt.Errorf("add IPv6 protocol address: %s", err)
		}
	}

	defaultSubnet, err := tcpip.NewSubnet(
		tcpip.AddrFrom4([4]byte{0, 0, 0, 0}),
		tcpip.MaskFromBytes([]byte{0, 0, 0, 0}),
	)
	if err != nil {
		return nil, fmt.Errorf("creating default subnet: %w", err)
	}

	defaultSubnetV6, err := tcpip.NewSubnet(
		tcpip.AddrFrom16([16]byte{}),
		tcpip.MaskFromBytes(make([]byte, 16)),
	)
	if err != nil {
		return nil, fmt.Errorf("creating default v6 subnet: %w", err)
	}

	if err := s.SetPromiscuousMode(nicID, true); err != nil {
		return nil, fmt.Errorf("set promiscuous mode: %s", err)
	}
	if err := s.SetSpoofing(nicID, true); err != nil {
		return nil, fmt.Errorf("set spoofing: %s", err)
	}

	s.SetRouteTable([]tcpip.Route{

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. No action needed for the literal-constant form; treat as an invariant assertion
2. If you refactored the mask to be computed, validate the prefix with tcpip.NewSubnet-adjacent logic or derive the mask via tcpip.MaskFromBits only from a valid prefix length
3. Report upstream if genuinely hit with unmodified constants, since it would indicate state corruption

// Go: this is an error return from a constructor
f, err := forwarder.New(iface, logger, flowLogger, netstack, mtu)
if err != nil {
    log.Errorf("forwarder init failed: %v", err)
    return err
}

When it happens

Trigger: Only fires if the hardcoded zero mask bytes are somehow non-contiguous (memory corruption, a fork of gVisor with different NewSubnet semantics, or a refactor that replaces the literals with computed masks).

Common situations: Virtually never seen in the field; appears in error catalogs because the constructor propagates it. Developers copying this code and substituting a computed mask (e.g. from user input) can hit it when the mask has non-contiguous bits.

Related errors

• creating default v6 subnet: %w
• add IPv6 protocol address: %s
• set promiscuous mode: %s
• set spoofing: %s
• output DNAT not supported without native firewall

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/99bd91fa0610e10e. Report an issue: GitHub.