netbirdio/netbird · error

rollback rule %s: %w

Error message

rollback rule %s: %w

What it means

Error "rollback rule %s: %w" thrown in netbirdio/netbird.

Source

Thrown at client/firewall/iptables/router_linux.go:871

// cleanupFailedDNATAdd removes the bookkeeping written by a partially applied
// AddDNATRule before rolling back the kernel rules, so no entries remain that
// never got a forwarding refcount. rollbackRules re-adds entries it failed to
// remove from the kernel.
func (r *router) cleanupFailedDNATAdd(rules map[string]ruleInfo) {
	for key := range rules {
		delete(r.rules, key)
	}
	if err := r.rollbackRules(rules); err != nil {
		log.Errorf("rollback failed: %v", err)
	}
}

func (r *router) rollbackRules(rules map[string]ruleInfo) error {
	var merr *multierror.Error
	for key, ruleInfo := range rules {
		if err := r.iptablesClient.DeleteIfExists(ruleInfo.table, ruleInfo.chain, ruleInfo.rule...); err != nil {
			merr = multierror.Append(merr, fmt.Errorf("rollback rule %s: %w", key, err))
			// On rollback error, add to rules map for next cleanup
			r.rules[key] = ruleInfo.rule
		}
	}
	if merr != nil {
		r.updateState()
	}
	return nberrors.FormatErrorOrNil(merr)
}

func (r *router) DeleteDNATRule(rule firewall.Rule) error {
	ruleKey := rule.ID()

	_, hadDNAT := r.rules[ruleKey+dnatSuffix]
	_, hadSNAT := r.rules[ruleKey+snatSuffix]
	_, hadFWD := r.rules[ruleKey+fwdSuffix]
	if !hadDNAT && !hadSNAT && !hadFWD {
		return nil

View on GitHub (pinned to 93e97f4bf1)

When it happens

Trigger: Thrown at client/firewall/iptables/router_linux.go:871 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/ec28b765695eb1fd. Report an issue: GitHub.