netbirdio/netbird · error

remove output DNAT: %w

Error message

remove output DNAT: %w

What it means

Error "remove output DNAT: %w" thrown in netbirdio/netbird.

Source

Thrown at client/firewall/nftables/manager_linux.go:668

	defer m.mutex.Unlock()

	if localAddr.Is6() {
		if !m.hasIPv6() {
			return fmt.Errorf("add output DNAT: %w", firewall.ErrIPv6NotInitialized)
		}
		return m.router6.AddOutputDNAT(localAddr, protocol, originalPort, translatedPort)
	}
	return m.router.AddOutputDNAT(localAddr, protocol, originalPort, translatedPort)
}

// RemoveOutputDNAT removes an OUTPUT chain DNAT rule.
func (m *Manager) RemoveOutputDNAT(localAddr netip.Addr, protocol firewall.Protocol, originalPort, translatedPort uint16) error {
	m.mutex.Lock()
	defer m.mutex.Unlock()

	if localAddr.Is6() {
		if !m.hasIPv6() {
			return fmt.Errorf("remove output DNAT: %w", firewall.ErrIPv6NotInitialized)
		}
		return m.router6.RemoveOutputDNAT(localAddr, protocol, originalPort, translatedPort)
	}
	return m.router.RemoveOutputDNAT(localAddr, protocol, originalPort, translatedPort)
}

const (
	chainNameRawOutput     = "netbird-raw-out"
	chainNameRawPrerouting = "netbird-raw-pre"
)

// SetupEBPFProxyNoTrack creates notrack rules for eBPF proxy loopback traffic.
// This prevents conntrack from tracking WireGuard proxy traffic on loopback, which
// can interfere with MASQUERADE rules (e.g., from container runtimes like Podman/netavark).
//
// Traffic flows that need NOTRACK:
//
//  1. Egress: WireGuard -> fake endpoint (before eBPF rewrite)

View on GitHub (pinned to 93e97f4bf1)

When it happens

Trigger: Thrown at client/firewall/nftables/manager_linux.go:668 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/9a35adc7a20a66ed. Report an issue: GitHub.