netbirdio/netbird · warning

reset router: %w

Error message

reset router: %w

What it means

During Manager.Close, the v4 router.Reset() failed - deleting the v4 NETBIRD routing chains, their jump rules from nat/mangle/filter built-ins, and v4 ipsets. It is the last firewall reset before firewalld.UntrustInterface; as with the sibling resets the error is accumulated, DeleteState is intentionally skipped, and the persisted ShutdownState retries on next start.

Source

Thrown at client/firewall/iptables/manager_linux.go:356

	if err := m.cleanupNoTrackChain(); err != nil {
		merr = multierror.Append(merr, fmt.Errorf("cleanup notrack chain: %w", err))
	}

	if m.hasIPv6() {
		if err := m.aclMgr6.Reset(); err != nil {
			merr = multierror.Append(merr, fmt.Errorf("reset v6 acl manager: %w", err))
		}
		if err := m.router6.Reset(); err != nil {
			merr = multierror.Append(merr, fmt.Errorf("reset v6 router: %w", err))
		}
	}

	if err := m.aclMgr.Reset(); err != nil {
		merr = multierror.Append(merr, fmt.Errorf("reset acl manager: %w", err))
	}
	if err := m.router.Reset(); err != nil {
		merr = multierror.Append(merr, fmt.Errorf("reset router: %w", err))
	}

	// Appending to merr intentionally blocks DeleteState below so ShutdownState
	// stays persisted and the crash-recovery path retries firewalld cleanup.
	if err := firewalld.UntrustInterface(m.wgIface.Name()); err != nil {
		merr = multierror.Append(merr, err)
	}

	// attempt to delete state only if all other operations succeeded
	if merr == nil {
		if err := stateManager.DeleteState(&ShutdownState{}); err != nil {
			merr = multierror.Append(merr, fmt.Errorf("delete state: %w", err))
		}
	}

	return nberrors.FormatErrorOrNil(merr)
}

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. Restart and cleanly stop the agent; the state-file recovery path finishes removal
2. Audit leftovers: iptables-save | grep NETBIRD and ipset list
3. Address the wrapped iptables/ipset error from the log if the failure reproduces on every stop

err := mgr.Close(stateManager)
if err != nil {
    log.Warnf("v4 router teardown incomplete; state persisted for next-start retry: %v", err)
}

When it happens

Trigger: Close where a v4 iptables or ipset delete fails - rules already flushed externally (docker/firewalld reload), ipset busy, or non-root stop.

Common situations: Host firewall rewrites racing agent shutdown; teardown after an external iptables-restore; repeated Close after partial failure.

Related errors

• reset v6 router: %w
• add route filtering: %w
• remove v4 NAT rule: %w
• remove v6 NAT rule: %w
• cleanup notrack chain: %w

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/89b07bf2f4aa2cf0. Report an issue: GitHub.