netbirdio/netbird · warning

remove windows firewall rule: %w

Error message

remove windows firewall rule: %w

What it means

Appended to a multierror in the uspfilter manager's Windows cleanup (client/firewall/uspfilter/allow_netbird_windows.go:37) when 'netsh advfirewall firewall delete rule name=NetBird' returns a non-zero exit. manageFirewallRule runs netsh via cmd.Run(); exit codes cover access-denied (service not elevated), the Windows Firewall/Group Policy blocking rule changes, the rule name being reported by isFirewallRuleActive but undeletable, or netsh missing from PATH/System32.

Source

Thrown at client/firewall/uspfilter/allow_netbird_windows.go:37

	deleteRule       action = "delete"
	firewallRuleName        = "Netbird"
)

// Close cleans up the firewall manager by removing all rules and closing trackers
func (m *Manager) Close(*statemanager.Manager) error {
	m.mutex.Lock()
	defer m.mutex.Unlock()

	m.resetState()

	if !isWindowsFirewallReachable() {
		return nil
	}

	var merr *multierror.Error
	if isFirewallRuleActive(firewallRuleName) {
		if err := manageFirewallRule(firewallRuleName, deleteRule); err != nil {
			merr = multierror.Append(merr, fmt.Errorf("remove windows firewall rule: %w", err))
		}
	}

	if isFirewallRuleActive(firewallRuleName + "-v6") {
		if err := manageFirewallRule(firewallRuleName+"-v6", deleteRule); err != nil {
			merr = multierror.Append(merr, fmt.Errorf("remove windows v6 firewall rule: %w", err))
		}
	}

	return nberrors.FormatErrorOrNil(merr)
}

// AllowNetbird allows netbird interface traffic
func (m *Manager) AllowNetbird() error {
	if !isWindowsFirewallReachable() {
		return nil
	}

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. Run the agent service as LocalSystem/Administrator so netsh can modify firewall rules
2. Check Windows Firewall service health: 'sc query mpssvc' and 'sc query bfe', start them if stopped
3. Delete the rule manually with 'netsh advfirewall firewall delete rule name="<ruleName>"' to surface the real netsh error text
4. If the firewall is intentionally locked by policy, accept the warning - the code already falls back to user-space filtering rules

Example fix

// before
if err := manageFirewallRule(firewallRuleName, deleteRule); err != nil {
    merr = multierror.Append(merr, fmt.Errorf("remove windows firewall rule: %w", err))
}
// after - capture netsh stderr so the failure is diagnosable
if err := manageFirewallRule(firewallRuleName, deleteRule); err != nil {
    log.Warnf("netsh delete %s failed (likely elevation/policy): %v", firewallRuleName, err)
    merr = multierror.Append(merr, fmt.Errorf("remove windows firewall rule: %w", err))
}

// elevation check before touching netsh
if !isElevated() {
    log.Warn("skipping Windows firewall rule management: not elevated")
    return nil
}
if !isWindowsFirewallReachable() {
    return nil
}

func isElevated() bool {
    var sid *windows.SID
    _ = windows.AllocateAndInitializeSid(&windows.SECURITY_NT_AUTHORITY, 2,
        windows.SECURITY_BUILTIN_DOMAIN_RID, windows.DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0, 0, &sid)
    defer windows.Free(sid)
    token := windows.GetCurrentProcessToken()
    member, _ := token.IsMember(sid)
    return member
}

if err := manager.Reset(nil); err != nil {
    for _, e := range unwrapMulti(err) {
        if strings.Contains(e.Error(), "windows firewall rule") {
            log.Warnf("windows firewall rule left behind: %v", e)
            continue // user-space rules still torn down
        }
        return err
    }
    return nil
}

When it happens

Trigger: Manager Reset running in a process without administrator rights; Windows Defender Firewall service (MpsSvc/BFE) stopped or policy-locked between the isFirewallRuleActive check and the delete; rule name duplicated so netsh refuses; corrupted firewall store.

Common situations: Running the agent binary manually (non-elevated) instead of the installed service; Group Policy 'Prohibit notifications' or firewall-policy lockdown modes; Windows embedded/IoT images without the full firewall stack; anti-malware interfering with netsh.

Related errors

• remove windows v6 firewall rule: %w
• remove v4 NAT rule: %w
• remove v6 NAT rule: %w
• cleanup notrack chain: %w
• reset v6 acl manager: %w

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/dcd5149edca800a7. Report an issue: GitHub.