netbirdio/netbird · warning

reset v6 router: %w

Error message

reset v6 router: %w

What it means

During Manager.Close, router6.Reset() failed - removing the v6 routing chains (NETBIRD-RT-NAT/FWD-IN/FWD-OUT/PRE/RDR/NAT-OUTPUT/MSSCLAMP), jump rules, and v6 ipsets created by the route manager. Accumulated into the multierror; subsequent v4 resets still run and DeleteState is blocked so the persisted state retries next start.

Source

Thrown at client/firewall/iptables/manager_linux.go:348

}

// Reset firewall to the default state
func (m *Manager) Close(stateManager *statemanager.Manager) error {
	m.mutex.Lock()
	defer m.mutex.Unlock()

	var merr *multierror.Error

	if err := m.cleanupNoTrackChain(); err != nil {
		merr = multierror.Append(merr, fmt.Errorf("cleanup notrack chain: %w", err))
	}

	if m.hasIPv6() {
		if err := m.aclMgr6.Reset(); err != nil {
			merr = multierror.Append(merr, fmt.Errorf("reset v6 acl manager: %w", err))
		}
		if err := m.router6.Reset(); err != nil {
			merr = multierror.Append(merr, fmt.Errorf("reset v6 router: %w", err))
		}
	}

	if err := m.aclMgr.Reset(); err != nil {
		merr = multierror.Append(merr, fmt.Errorf("reset acl manager: %w", err))
	}
	if err := m.router.Reset(); err != nil {
		merr = multierror.Append(merr, fmt.Errorf("reset router: %w", err))
	}

	// Appending to merr intentionally blocks DeleteState below so ShutdownState
	// stays persisted and the crash-recovery path retries firewalld cleanup.
	if err := firewalld.UntrustInterface(m.wgIface.Name()); err != nil {
		merr = multierror.Append(merr, err)
	}

	// attempt to delete state only if all other operations succeeded
	if merr == nil {

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. Cycle the agent (start then stop) so the ShutdownState recovery path completes teardown
2. Check and clean manually: ip6tables-save | grep NETBIRD and ipset list
3. Look at the wrapped error in daemon logs to distinguish 'already gone' from a real ipset/ip6tables fault

if err := mgr.Close(stateManager); err != nil {
    log.Warnf("close incomplete (v6 router reset failed); persisted state retries next start: %v", err)
}

When it happens

Trigger: Close with hasIPv6() true and a failing ip6tables/ipset delete in the v6 router teardown - typically rules or ipsets already removed externally, or ipset busy because another process references it.

Common situations: External ip6tables flush mid-shutdown; leftover ipsets with refcounts; repeated teardown after a partially failed earlier Close.

Related errors

• add route filtering: %w
• remove v6 NAT rule: %w
• reset v6 acl manager: %w
• reset router: %w
• remove inbound DNAT: %w

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/ee92bbb6b2582abb. Report an issue: GitHub.