netbirdio/netbird · error

notrack chains not initialized

Error message

notrack chains not initialized

What it means

Error "notrack chains not initialized" thrown in netbirdio/netbird.

Source

Thrown at client/firewall/nftables/manager_linux.go:708

//  2. Egress: Proxy -> WireGuard (via raw socket)
//     src=127.0.0.1:fakePort -> dst=127.0.0.1:wgPort
//     Matched by: dport=wgPort
//
//  3. Ingress: Packets to WireGuard
//     dst=127.0.0.1:wgPort
//     Matched by: dport=wgPort
//
//  4. Ingress: Packets to proxy (after eBPF rewrite)
//     dst=127.0.0.1:proxyPort
//     Matched by: dport=proxyPort
//
// Rules are cleaned up when the firewall manager is closed.
func (m *Manager) SetupEBPFProxyNoTrack(proxyPort, wgPort uint16) error {
	m.mutex.Lock()
	defer m.mutex.Unlock()

	if m.notrackOutputChain == nil || m.notrackPreroutingChain == nil {
		return fmt.Errorf("notrack chains not initialized")
	}

	proxyPortBytes := binaryutil.BigEndian.PutUint16(proxyPort)
	wgPortBytes := binaryutil.BigEndian.PutUint16(wgPort)
	loopback := []byte{127, 0, 0, 1}

	// Egress rules: match outgoing loopback UDP packets
	m.rConn.AddRule(&nftables.Rule{
		Table: m.notrackOutputChain.Table,
		Chain: m.notrackOutputChain,
		Exprs: []expr.Any{
			&expr.Meta{Key: expr.MetaKeyOIFNAME, Register: 1},
			&expr.Cmp{Op: expr.CmpOpEq, Register: 1, Data: ifname("lo")},
			&expr.Payload{DestRegister: 1, Base: expr.PayloadBaseNetworkHeader, Offset: 12, Len: 4}, // saddr
			&expr.Cmp{Op: expr.CmpOpEq, Register: 1, Data: loopback},
			&expr.Payload{DestRegister: 1, Base: expr.PayloadBaseNetworkHeader, Offset: 16, Len: 4}, // daddr
			&expr.Cmp{Op: expr.CmpOpEq, Register: 1, Data: loopback},
			&expr.Meta{Key: expr.MetaKeyL4PROTO, Register: 1},

View on GitHub (pinned to 93e97f4bf1)

When it happens

Trigger: Thrown at client/firewall/nftables/manager_linux.go:708 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/0e48a130564b8da0. Report an issue: GitHub.