netbirdio/netbird · error

enable forwarding: %w

Error message

enable forwarding: %w

What it means

Error "enable forwarding: %w" thrown in netbirdio/netbird.

Source

Thrown at client/firewall/iptables/router_linux.go:847

	}
	forwardRule = append(forwardRule, applyPort("--dport", &rule.TranslatedPort)...)
	rules[ruleKey+fwdSuffix] = ruleInfo{
		table: tableFilter,
		chain: chainRTFWDOUT,
		rule:  forwardRule,
	}

	for key, ruleInfo := range rules {
		if err := r.iptablesClient.Append(ruleInfo.table, ruleInfo.chain, ruleInfo.rule...); err != nil {
			r.cleanupFailedDNATAdd(rules)
			return nil, fmt.Errorf("add rule %s: %w", key, err)
		}
		r.rules[key] = ruleInfo.rule
	}

	if err := r.ipFwdState.RequestForwarding(r.v6); err != nil {
		r.cleanupFailedDNATAdd(rules)
		return nil, fmt.Errorf("enable forwarding: %w", err)
	}

	r.updateState()
	return rule, nil
}

// cleanupFailedDNATAdd removes the bookkeeping written by a partially applied
// AddDNATRule before rolling back the kernel rules, so no entries remain that
// never got a forwarding refcount. rollbackRules re-adds entries it failed to
// remove from the kernel.
func (r *router) cleanupFailedDNATAdd(rules map[string]ruleInfo) {
	for key := range rules {
		delete(r.rules, key)
	}
	if err := r.rollbackRules(rules); err != nil {
		log.Errorf("rollback failed: %v", err)
	}
}

View on GitHub (pinned to 93e97f4bf1)

When it happens

Trigger: Thrown at client/firewall/iptables/router_linux.go:847 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/723999464ac3ea3c. Report an issue: GitHub.