netbirdio/netbird · error

delete forward rule: %w

Error message

delete forward rule: %w

What it means

Error "delete forward rule: %w" thrown in netbirdio/netbird.

Source

Thrown at client/firewall/iptables/router_linux.go:911

	if dnatRule, exists := r.rules[ruleKey+dnatSuffix]; exists {
		if err := r.iptablesClient.Delete(tableNat, chainRTRDR, dnatRule...); err != nil {
			merr = multierror.Append(merr, fmt.Errorf("delete DNAT rule: %w", err))
		} else {
			delete(r.rules, ruleKey+dnatSuffix)
		}
	}

	if snatRule, exists := r.rules[ruleKey+snatSuffix]; exists {
		if err := r.iptablesClient.Delete(tableNat, chainRTNAT, snatRule...); err != nil {
			merr = multierror.Append(merr, fmt.Errorf("delete SNAT rule: %w", err))
		} else {
			delete(r.rules, ruleKey+snatSuffix)
		}
	}

	if fwdRule, exists := r.rules[ruleKey+fwdSuffix]; exists {
		if err := r.iptablesClient.Delete(tableFilter, chainRTFWDOUT, fwdRule...); err != nil {
			merr = multierror.Append(merr, fmt.Errorf("delete forward rule: %w", err))
		} else {
			delete(r.rules, ruleKey+fwdSuffix)
		}
	}

	// Release the refcount only once all rules are gone from the kernel. On
	// partial failure the failed entries stay in r.rules so a retry can remove
	// them and release then.
	if merr == nil {
		if err := r.ipFwdState.ReleaseForwarding(r.v6); err != nil {
			log.Errorf("%v", err)
		}
	}

	r.updateState()
	return nberrors.FormatErrorOrNil(merr)
}

View on GitHub (pinned to 93e97f4bf1)

When it happens

Trigger: Thrown at client/firewall/iptables/router_linux.go:911 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/39b9f866edeec8b3. Report an issue: GitHub.