netbirdio/netbird · error

init IPv6 firewall (required because peer has IPv6 address):

Error message

init IPv6 firewall (required because peer has IPv6 address): %w

What it means

Error "init IPv6 firewall (required because peer has IPv6 address): %w" thrown in netbirdio/netbird.

Source

Thrown at client/firewall/nftables/manager_linux.go:201

	defer func() {
		if err != nil {
			m.rollbackInit()
		}
	}()

	if err := m.router.init(workTable); err != nil {
		return fmt.Errorf("router init: %w", err)
	}

	if err := m.aclManager.init(workTable); err != nil {
		return fmt.Errorf("acl manager init: %w", err)
	}

	if m.hasIPv6() {
		if err := m.initIPv6(); err != nil {
			// Peer has a v6 address: v6 firewall MUST work or we risk fail-open.
			return fmt.Errorf("init IPv6 firewall (required because peer has IPv6 address): %w", err)
		}
	}

	if err := m.initNoTrackChains(workTable); err != nil {
		log.Warnf("raw priority chains not available, notrack rules will be disabled: %v", err)
	}

	return nil
}

// persistState saves the current interface state for potential recreation on restart.
// Unlike iptables, which requires tracking individual rules, nftables maintains
// a known state (our netbird table plus a few static rules). This allows for easy
// cleanup using Close() without needing to store specific rules.
func (m *Manager) persistState(stateManager *statemanager.Manager) {
	stateManager.RegisterState(&ShutdownState{})

	if err := stateManager.UpdateState(&ShutdownState{

View on GitHub (pinned to 93e97f4bf1)

When it happens

Trigger: Thrown at client/firewall/nftables/manager_linux.go:201 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/35ea0d1bf2cbdeb4. Report an issue: GitHub.