netbirdio/netbird · error

invalid IP address, skipping firewall rule

Error message

invalid IP address, skipping firewall rule

What it means

Error "invalid IP address, skipping firewall rule" thrown in netbirdio/netbird.

Source

Thrown at client/internal/acl/manager.go:426

}


// extractRuleIP extracts the peer IP from a firewall rule.
// If sourcePrefixes is populated (new management), decode the first entry and use its address.
// Otherwise fall back to the deprecated PeerIP string field (old management).
func extractRuleIP(r *mgmProto.FirewallRule) (netip.Addr, error) {
	if len(r.SourcePrefixes) > 0 {
		addr, err := netiputil.DecodeAddr(r.SourcePrefixes[0])
		if err != nil {
			return netip.Addr{}, fmt.Errorf("decode source prefix: %w", err)
		}
		return addr.Unmap(), nil
	}

	//nolint:staticcheck // PeerIP used for backward compatibility with old management
	addr, err := netip.ParseAddr(r.PeerIP)
	if err != nil {
		return netip.Addr{}, fmt.Errorf("invalid IP address, skipping firewall rule")
	}
	return addr.Unmap(), nil
}

func convertToFirewallProtocol(protocol mgmProto.RuleProtocol) (firewall.Protocol, error) {
	switch protocol {
	case mgmProto.RuleProtocol_TCP:
		return firewall.ProtocolTCP, nil
	case mgmProto.RuleProtocol_UDP:
		return firewall.ProtocolUDP, nil
	case mgmProto.RuleProtocol_ICMP:
		return firewall.ProtocolICMP, nil
	case mgmProto.RuleProtocol_ALL:
		return firewall.ProtocolALL, nil
	default:
		return firewall.ProtocolALL, fmt.Errorf("invalid protocol type: %s", protocol.String())
	}
}

View on GitHub (pinned to 93e97f4bf1)

When it happens

Trigger: Thrown at client/internal/acl/manager.go:426 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/15115d1aac857c5c. Report an issue: GitHub.