netbirdio/netbird · error

delete SNAT rule: %w

Error message

delete SNAT rule: %w

What it means

Error "delete SNAT rule: %w" thrown in netbirdio/netbird.

Source

Thrown at client/firewall/iptables/router_linux.go:903

	_, hadDNAT := r.rules[ruleKey+dnatSuffix]
	_, hadSNAT := r.rules[ruleKey+snatSuffix]
	_, hadFWD := r.rules[ruleKey+fwdSuffix]
	if !hadDNAT && !hadSNAT && !hadFWD {
		return nil
	}

	var merr *multierror.Error
	if dnatRule, exists := r.rules[ruleKey+dnatSuffix]; exists {
		if err := r.iptablesClient.Delete(tableNat, chainRTRDR, dnatRule...); err != nil {
			merr = multierror.Append(merr, fmt.Errorf("delete DNAT rule: %w", err))
		} else {
			delete(r.rules, ruleKey+dnatSuffix)
		}
	}

	if snatRule, exists := r.rules[ruleKey+snatSuffix]; exists {
		if err := r.iptablesClient.Delete(tableNat, chainRTNAT, snatRule...); err != nil {
			merr = multierror.Append(merr, fmt.Errorf("delete SNAT rule: %w", err))
		} else {
			delete(r.rules, ruleKey+snatSuffix)
		}
	}

	if fwdRule, exists := r.rules[ruleKey+fwdSuffix]; exists {
		if err := r.iptablesClient.Delete(tableFilter, chainRTFWDOUT, fwdRule...); err != nil {
			merr = multierror.Append(merr, fmt.Errorf("delete forward rule: %w", err))
		} else {
			delete(r.rules, ruleKey+fwdSuffix)
		}
	}

	// Release the refcount only once all rules are gone from the kernel. On
	// partial failure the failed entries stay in r.rules so a retry can remove
	// them and release then.
	if merr == nil {
		if err := r.ipFwdState.ReleaseForwarding(r.v6); err != nil {

View on GitHub (pinned to 93e97f4bf1)

When it happens

Trigger: Thrown at client/firewall/iptables/router_linux.go:903 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/eecf2663f724f6e1. Report an issue: GitHub.