netbirdio/netbird · error

flush external chain rules: %w

Error message

flush external chain rules: %w

What it means

Error "flush external chain rules: %w" thrown in netbirdio/netbird.

Source

Thrown at client/firewall/nftables/router_linux.go:1183

	return r.conn.Flush()
}

// acceptExternalChainsRules adds accept rules to external chains (non-netbird, non-iptables tables).
// It dynamically finds chains at call time to handle chains that may have been created after startup.
func (r *router) acceptExternalChainsRules() error {
	chains := r.findExternalChains()
	if len(chains) == 0 {
		return nil
	}

	intf := ifname(r.wgIface.Name())
	for _, chain := range chains {
		r.applyExternalChainAccept(chain, intf)
	}

	if err := r.conn.Flush(); err != nil {
		return fmt.Errorf("flush external chain rules: %w", err)
	}
	return nil
}

func (r *router) applyExternalChainAccept(chain *nftables.Chain, intf []byte) {
	if chain.Hooknum == nil {
		log.Debugf("skipping external chain %s/%s: hooknum is nil", chain.Table.Name, chain.Name)
		return
	}

	log.Debugf("adding accept rules to external %s chain: %s %s/%s",
		hookName(chain.Hooknum), familyName(chain.Table.Family), chain.Table.Name, chain.Name)

	switch *chain.Hooknum {
	case *nftables.ChainHookForward:
		r.insertForwardAcceptRules(chain, intf)
	case *nftables.ChainHookInput:
		r.insertInputAcceptRule(chain, intf)

View on GitHub (pinned to 93e97f4bf1)

When it happens

Trigger: Thrown at client/firewall/nftables/router_linux.go:1183 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/604dacb6c44ee16c. Report an issue: GitHub.