netbirdio/netbird · error

get rules from %s/%s: %v

Error message

get rules from %s/%s: %v

What it means

Error "get rules from %s/%s: %v" thrown in netbirdio/netbird.

Source

Thrown at client/firewall/nftables/router_linux.go:1354

			continue
		}

		if chain.Name != chainNameForward && chain.Name != chainNameInput {
			continue
		}

		if err := r.removeAcceptRulesFromChain(table, chain); err != nil {
			return err
		}
	}

	return r.conn.Flush()
}

func (r *router) removeAcceptRulesFromChain(table *nftables.Table, chain *nftables.Chain) error {
	rules, err := r.conn.GetRules(table, chain)
	if err != nil {
		return fmt.Errorf("get rules from %s/%s: %v", table.Name, chain.Name, err)
	}

	for _, rule := range rules {
		if bytes.Equal(rule.UserData, []byte(userDataAcceptForwardRuleIif)) ||
			bytes.Equal(rule.UserData, []byte(userDataAcceptForwardRuleOif)) ||
			bytes.Equal(rule.UserData, []byte(userDataAcceptInputRule)) {
			if err := r.conn.DelRule(rule); err != nil {
				return fmt.Errorf("delete rule from %s/%s: %v", table.Name, chain.Name, err)
			}
		}
	}
	return nil
}

// removeExternalChainsRules removes our accept rules from all external chains.
// This is deterministic - it scans for chains at removal time rather than relying on saved state,
// ensuring cleanup works even after a crash or if chains changed.
func (r *router) removeExternalChainsRules() error {

View on GitHub (pinned to 93e97f4bf1)

When it happens

Trigger: Thrown at client/firewall/nftables/router_linux.go:1354 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/5a7cb18e3bb71737. Report an issue: GitHub.