netbirdio/netbird · error

remove external chain rules: %w

Error message

remove external chain rules: %w

What it means

Error "remove external chain rules: %w" thrown in netbirdio/netbird.

Source

Thrown at client/firewall/nftables/router_linux.go:1304

func isNetbirdAcceptRuleTag(userData []byte) bool {
	switch string(userData) {
	case userDataAcceptForwardRuleIif,
		userDataAcceptForwardRuleOif,
		userDataAcceptInputRule:
		return true
	}
	return false
}

func (r *router) removeAcceptFilterRules() error {
	var merr *multierror.Error

	if err := r.removeFilterTableRules(); err != nil {
		merr = multierror.Append(merr, err)
	}

	if err := r.removeExternalChainsRules(); err != nil {
		merr = multierror.Append(merr, fmt.Errorf("remove external chain rules: %w", err))
	}

	return nberrors.FormatErrorOrNil(merr)
}

func (r *router) removeFilterTableRules() error {
	if r.filterTable == nil {
		return nil
	}

	ipt, err := iptables.NewWithProtocol(r.iptablesProto())
	if err != nil {
		log.Debugf("iptables not available, using nftables to remove filter rules: %v", err)
		return r.removeAcceptRulesFromTable(r.filterTable)
	}

	if err := r.removeAcceptFilterRulesIptables(ipt); err != nil {
		log.Debugf("iptables removal failed (table may be incompatible), falling back to nftables: %v", err)

View on GitHub (pinned to 93e97f4bf1)

When it happens

Trigger: Thrown at client/firewall/nftables/router_linux.go:1304 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/7e1fc9dcacbc49a1. Report an issue: GitHub.