Otbr-agent exits with code 4 when NAT64 is activated

I want to add Nuki 4 Smart Lock to Home Assistant.
Matter works with disabled NAT64 Support, but Nuki Smart Lock seems to need NAT64.
When I activate NAT64 in OpenThread Border Router the service ends with exit code 4.

Does anyone have a solution for this error?
Any help is appreciated.

System
Home Assistant Blue / Hardkernel ODROID-N2/N2+

  • Core 2024.6.2
  • Supervisor 2024.06.0
  • Operating System 12.2
  • Frontend 20240610.0

Log

-----------------------------------------------------------
 Add-on: OpenThread Border Router
 OpenThread Border Router add-on
-----------------------------------------------------------
 Add-on version: 2.6.0
 You are running the latest version of this add-on.
 System: Home Assistant OS 12.2  (aarch64 / odroid-n2)
 Home Assistant Core: 2024.6.2
 Home Assistant Supervisor: 2024.06.0
-----------------------------------------------------------
 Please, share the above information when looking for help
 or support in, e.g., GitHub, forums or the Discord chat.
-----------------------------------------------------------
s6-rc: info: service banner successfully started
s6-rc: info: service universal-silabs-flasher: starting
[21:31:10] INFO: Flashing firmware is disabled
s6-rc: info: service universal-silabs-flasher successfully started
s6-rc: info: service otbr-agent: starting
[21:31:11] INFO: Setup OTBR firewall...
Warning: Extension MARK revision 0 not supported, missing kernel module?
iptables v1.8.9 (nf_tables):  RULE_APPEND failed (No such file or directory): rule in chain PREROUTING
[21:31:11] WARNING: otbr-agent exited with code 4 (by signal 0).
Chain OTBR_FORWARD_INGRESS (0 references)
target     prot opt source               destination         
DROP       all  --  anywhere             anywhere             PKTTYPE = unicast
DROP       all  --  anywhere             anywhere             match-set otbr-ingress-deny-src src
ACCEPT     all  --  anywhere             anywhere             match-set otbr-ingress-allow-dst dst
DROP       all  --  anywhere             anywhere             PKTTYPE = unicast
ACCEPT     all  --  anywhere             anywhere            
otbr-ingress-deny-src
otbr-ingress-deny-src-swap
otbr-ingress-allow-dst
otbr-ingress-allow-dst-swap
Chain OTBR_FORWARD_EGRESS (0 references)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
[21:31:11] INFO: OTBR firewall teardown completed.
s6-svlisten1: fatal: /run/s6-rc/servicedirs/otbr-agent failed permanently or its supervisor died
s6-rc: warning: unable to start service otbr-agent: command exited 1
/run/s6/basedir/scripts/rc.init: warning: s6-rc failed to properly bring all the services up! Check your logs (in /run/uncaught-logs/current if you have in-container logging) for more information.
/run/s6/basedir/scripts/rc.init: fatal: stopping the container.
s6-rc: info: service legacy-cont-init: stopping
s6-rc: info: service universal-silabs-flasher: stopping
s6-rc: info: service mdns: stopping
Default: mDNSResponder (Engineering Build) (Apr 26 2024 10:06:25) stopping
s6-rc: info: service universal-silabs-flasher successfully stopped
s6-rc: info: service banner: stopping
s6-rc: info: service banner successfully stopped
s6-rc: info: service legacy-cont-init successfully stopped
s6-rc: info: service fix-attrs: stopping
s6-rc: info: service fix-attrs successfully stopped
s6-rc: info: service s6rc-oneshot-runner: stopping
s6-rc: info: service s6rc-oneshot-runner successfully stopped
[21:31:11] INFO: mDNS ended with exit code 4 (signal 0)...
s6-rc: info: service mdns successfully stopped

I just enabled it on my setup and it went without problems.
I have only the HAOS different from you. It is 12.3

Try updating the HAOS and if that does not work, then it might be something with your network setup.

Hm, seems the OTBR wasn’t able to setup firewalling. Do you maybe have other add-ons installed which could interfere on a networking/firewalling level?

I’ve seen intances where some dangling firewall rules caused issues, a full system restart might help in this case.

Hella agners and Wally,
thanks for your reply.

Installed Add-ons
Lets Encrypt, Matter Server, Open Thread Border Router, Studio Code Server

Network
ip4 and ip6 set to auto (Standard). Both Protokols got an IP.
Network Adapter
Auto Configure (Standard)

Cold rebooted system. Same error Message.

Warning: Extension MARK revision 0 not supported, missing kernel module?

This message only appears when activating NAT64

I configured nothing special on this system. Maybe its really an OS bug?.
HAOS shows no updates to install. Hard way for fix may be reinstalling the system and restore a backup. Are there other options?

There should be a 12.3 version available for you, but it looks like it is named for board versions and not architectures anymore.

Thanks. I will migrate to 12.3 and update this thread afterwards.

Reinstalled with OS 12.3 and restored a backup. The error still exist. Also with OS 12.4.

I could test with reinstall and do not restore a backup. But actually I got not enough spare time for starting a fresh HA configuration.

Same Error on my Installation,

[19:16:18] WARNING: otbr-agent exited with code 4 (by signal 0).

When NAT64 enabled

System
Home Assistant Blue / Hardkernel ODROID-N2/N2+

  • Core2024.6.4
  • Supervisor2024.06.2
  • Operating System12.4
  • Frontend20240610.1
[19:20:23] INFO: Web UI and REST API port are exposed, starting otbr-web.
s6-rc: info: service mdns: starting
s6-rc: info: service s6rc-oneshot-runner: starting
s6-rc: info: service mdns successfully started
s6-rc: info: service s6rc-oneshot-runner successfully started
s6-rc: info: service fix-attrs: starting
s6-rc: info: service banner: starting
s6-rc: info: service fix-attrs successfully started
s6-rc: info: service legacy-cont-init: starting
s6-rc: info: service legacy-cont-init successfully started
[19:20:23] INFO: Starting mDNS Responder...
Default: mDNSResponder (Engineering Build) (Jul  2 2024 09:08:57) starting

-----------------------------------------------------------
 Add-on: OpenThread Border Router
 OpenThread Border Router add-on
-----------------------------------------------------------
 Add-on version: 2.9.0
 You are running the latest version of this add-on.
 System: Home Assistant OS 12.4  (aarch64 / odroid-n2)
 Home Assistant Core: 2024.6.4
 Home Assistant Supervisor: 2024.06.2
-----------------------------------------------------------
 Please, share the above information when looking for help
 or support in, e.g., GitHub, forums or the Discord chat.
-----------------------------------------------------------
s6-rc: info: service banner successfully started
s6-rc: info: service universal-silabs-flasher: starting
[19:20:25] INFO: Checking /dev/ttyUSB0 identifying SkyConnect v1.0 from Nabu Casa.
[19:20:25] INFO: Starting universal-silabs-flasher with /dev/ttyUSB0
2024-07-02 19:20:26.386 ha universal_silabs_flasher.flash INFO Extracted GBL metadata: NabuCasaMetadata(metadata_version=1, sdk_version='4.4.0', ezsp_version=None, ot_rcp_version='SL-OPENTHREAD/2.4.0.0_GitHub-7074a43e4' (2.4.0.0), cpc_version=None, fw_type=<FirmwareImageType.OT_RCP: 'ot-rcp'>, baudrate=460800)
2024-07-02 19:20:26.386 ha universal_silabs_flasher.flasher INFO Probing ApplicationType.GECKO_BOOTLOADER at 115200 baud
2024-07-02 19:20:28.392 ha universal_silabs_flasher.flasher INFO Probing ApplicationType.SPINEL at 460800 baud
2024-07-02 19:20:29.505 ha universal_silabs_flasher.flasher INFO Detected ApplicationType.SPINEL, version 'SL-OPENTHREAD/2.4.0.0_GitHub-7074a43e4' (2.4.0.0) at 460800 baudrate (bootloader baudrate None)
2024-07-02 19:20:29.505 ha universal_silabs_flasher.flash INFO Firmware version 'SL-OPENTHREAD/2.4.0.0_GitHub-7074a43e4' (2.4.0.0) is flashed, not re-installing
s6-rc: info: service universal-silabs-flasher successfully started
s6-rc: info: service otbr-agent: starting
[19:20:30] INFO: Setup OTBR firewall...
Warning: Extension MARK revision 0 not supported, missing kernel module?
iptables v1.8.9 (nf_tables):  RULE_APPEND failed (No such file or directory): rule in chain PREROUTING
[19:20:30] WARNING: otbr-agent exited with code 4 (by signal 0).
Chain OTBR_FORWARD_INGRESS (0 references)
target     prot opt source               destination         
DROP       all  --  anywhere             anywhere             PKTTYPE = unicast
DROP       all  --  anywhere             anywhere             match-set otbr-ingress-deny-src src
ACCEPT     all  --  anywhere             anywhere             match-set otbr-ingress-allow-dst dst
DROP       all  --  anywhere             anywhere             PKTTYPE = unicast
ACCEPT     all  --  anywhere             anywhere            
otbr-ingress-deny-src
otbr-ingress-deny-src-swap
otbr-ingress-allow-dst
otbr-ingress-allow-dst-swap
Chain OTBR_FORWARD_EGRESS (0 references)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
[19:20:31] INFO: OTBR firewall teardown completed.
s6-svlisten1: fatal: /run/s6-rc/servicedirs/otbr-agent failed permanently or its supervisor died
s6-rc: warning: unable to start service otbr-agent: command exited 1
s6-rc: info: service legacy-cont-init: stopping
s6-rc: info: service universal-silabs-flasher: stopping
s6-rc: info: service mdns: stopping
/run/s6/basedir/scripts/rc.init: warning: s6-rc failed to properly bring all the services up! Check your logs (in /run/uncaught-logs/current if you have in-container logging) for more information.
Default: mDNSResponder (Engineering Build) (Jul  2 2024 09:08:57) stopping
s6-rc: info: service universal-silabs-flasher successfully stopped
/run/s6/basedir/scripts/rc.init: fatal: stopping the container.
s6-rc: info: service banner: stopping
s6-rc: info: service banner successfully stopped
s6-rc: info: service legacy-cont-init successfully stopped
s6-rc: info: service fix-attrs: stopping
s6-rc: info: service fix-attrs successfully stopped
s6-rc: info: service s6rc-oneshot-runner: stopping
s6-rc: info: service s6rc-oneshot-runner successfully stopped
[19:20:31] INFO: mDNS ended with exit code 4 (signal 0)...
s6-rc: info: service mdns successfully stopped

Maybe, as it says, the ODROID is missing some kernel modules (?).
Just googling around some for that error, some suggest there may possibly be a missing kernel compile flag or two, some suggest loading a few kernel modules to get it to work. Either way, it may be worth raising an issue with HA OS on github to see what their take is (I see agners responded above, but again suggest raising the issue on github).