What causes "add v6 filter: %w" in slackhq/nebula?

Inspect the wrapped FWPM error code for the exact cause.

add v6 filter: %w

Error message

add v6 filter: %w

What it means

PermitInterface failed to install the IPv6 WFP permit filter at FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 for the given interface LUID, after the V4 filter succeeded. The session is closed to roll back, and the underlying addInterfaceFilter error is wrapped with %w.

Source

Thrown at wfp/wfp_windows.go:213

	procFwpmEngineClose0.Call(s.engine)
	s.engine = 0
}

// PermitInterface installs PERMIT filters at FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 and _V6 scoped to the given network
// interface LUID. Inbound traffic on that interface bypasses Windows Defender Firewall.
func PermitInterface(luid uint64) (*Session, error) {
	s, sublayerKey, err := newSession()
	if err != nil {
		return nil, err
	}

	if err := addInterfaceFilter(s.engine, sublayerKey, fwpmLayerAleAuthRecvAcceptV4, luid); err != nil {
		s.Close()
		return nil, fmt.Errorf("add v4 filter: %w", err)
	}
	if err := addInterfaceFilter(s.engine, sublayerKey, fwpmLayerAleAuthRecvAcceptV6, luid); err != nil {
		s.Close()
		return nil, fmt.Errorf("add v6 filter: %w", err)
	}
	return s, nil
}

// PermitUDPPort installs PERMIT filters at FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 and _V6 scoped to UDP traffic with the
// given local port. Inbound UDP to that port on any interface bypasses Windows Defender Firewall.
func PermitUDPPort(port uint16) (*Session, error) {
	s, sublayerKey, err := newSession()
	if err != nil {
		return nil, err
	}

	if err := addUDPPortFilter(s.engine, sublayerKey, fwpmLayerAleAuthRecvAcceptV4, port); err != nil {
		s.Close()
		return nil, fmt.Errorf("add v4 filter: %w", err)
	}
	if err := addUDPPortFilter(s.engine, sublayerKey, fwpmLayerAleAuthRecvAcceptV6, port); err != nil {
		s.Close()

View on GitHub (pinned to dd8f660c0a)

Solutions

Inspect the wrapped FWPM error code for the exact cause.
If IPv6 is intentionally disabled on the host, treat a V6-layer failure as non-fatal or skip V6 filtering.
Run elevated and verify no third-party firewall provider is rejecting the filter add.
Re-enable IPv6 in Windows if the V6 WFP layers are needed.

Example fix

// before
if err := addInterfaceFilter(s.engine, sublayerKey, fwpmLayerAleAuthRecvAcceptV6, luid); err != nil {
	s.Close()
	return nil, fmt.Errorf("add v6 filter: %w", err)
}
// after
if err := addInterfaceFilter(s.engine, sublayerKey, fwpmLayerAleAuthRecvAcceptV6, luid); err != nil {
	s.Close()
	if ipv6DisabledOnHost() { return permitV4Only() }
	return nil, fmt.Errorf("add v6 filter: %w", err)
}

Defensive patterns

Strategy: fallback

Validate before calling

// detect IPv6 availability before requesting V6 filters
v6Enabled, _ := ipv6Supported()
if !v6Enabled {
	// skip PermitInterface or accept v4-only bypass coverage
}

Type guard

func isV6FilterErr(err error) bool { return err != nil && strings.Contains(err.Error(), "add v6 filter") }

Try / catch

session, err := wfp.PermitInterface(luid)
if err != nil && isV6FilterErr(err) {
	// degrade: v4 filter succeeded but session was closed; retry with v4-only path if available
	return err
}

Prevention

Know the host's IPv6 state (netsh interface ipv6 show interfaces) before installing V6 filters.
Treat V6 filter failure distinctly from V4: check which layer failed in the message.
Run elevated and verify WFP provider conflicts.
Keep an operational fallback that does not require V6 bypass.

When it happens

Trigger: Calling wfp.PermitInterface when the V6 addInterfaceFilter fails - commonly because IPv6 is disabled on the host, the V6 layer/provider is unavailable, or FwpmFilterAdd0 returns FWPE_E_LAYER_NOT_FOUND / access denied.

Common situations: Hosts with IPv6 disabled via netsh or registry (WFP V6 layers still exist but conditions may fail); admin-less execution; security software blocking filter registration; partial success confusion when V4 succeeded but V6 fails.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/2e584c84bee4da35. Report an issue: GitHub.