XTLS/Xray-core · error

illegal ip rule:

Error message

illegal ip rule: 

What it means

Wraps any failure from parseCustomIPRule/parseGeoIPRule while converting the i-th string of an IP rule list into a structured IRule. The offending raw rule text is embedded in the message, and the base error names the actual cause (syntax error, empty file/code, bad CIDR, etc.).

Source

Thrown at common/geodata/rule_parser.go:42

		}

		prefix := 0
		for _, ext := range [...]string{"ext:", "ext-ip:"} {
			if strings.HasPrefix(r, ext) {
				prefix = len(ext)
				break
			}
		}

		var rule isIPRule_Value
		var err error
		if prefix > 0 {
			rule, err = parseGeoIPRule(r[prefix:], reverse)
		} else {
			rule, err = parseCustomIPRule(r, reverse)
		}
		if err != nil {
			return nil, errors.New("illegal ip rule: ", rules[i]).Base(err)
		}
		ipRules = append(ipRules, &IPRule{Value: rule})
	}

	return ipRules, nil
}

func cutReversePrefix(s string) (string, bool) {
	reverse := false
	for strings.HasPrefix(s, "!") {
		s = s[1:]
		reverse = !reverse
	}
	return s, reverse
}

func parseGeoIPRule(rule string, reverse bool) (*IPRule_Geoip, error) {
	file, code, ok := strings.Cut(rule, ":")

View on GitHub (pinned to 7d214f8b09)

Solutions

1. Read the base error and the echoed rule string; fix the specific sub-error (add missing code, fix CIDR).
2. Ensure IP rules use forms: "geoip:CODE", "ext:FILE.dat:CODE", optionally prefixed with '!', or plain IP/CIDR.
3. Run `xray run -test -c config.json` to validate before deploying.

Example fix

// before
"ip": ["geoip:", "1.2.3.4/40"]

// after
"ip": ["geoip:cn", "1.2.3.4/32"]

var ipRuleRe = regexp.MustCompile(`^(!+)?(geoip:[a-zA-Z]{2}|ext:[\w.-]+\.dat:!?[a-zA-Z]{2}|[0-9a-fA-F:.]+(/\d+)?)$`)
for _, r := range rules {
    if !ipRuleRe.MatchString(r) { return fmt.Errorf("suspicious ip rule %q", r) }
}

if _, err := geodata.ParseIPRules(rules); err != nil { /* err message contains the raw rule; log and fail fast at startup */ }

When it happens

Trigger: ParseIPRules receiving strings like "geoip:cn:", "ext:file.dat:", "!", "1.2.3.4/33", or a plain token that is neither a CIDR nor an IP (e.g. "not-an-ip").

Common situations: Typos in route rules — missing country code after geoip:, forgotten : separator, prefix length > 32/128, using domain strings in the ip array by mistake.

Related errors

• illegal domain rule:
• failed to check code
• varint overflow
• invalid body length:
• no valid ip matcher

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/5a79ec1d2a7069b2. Report an issue: GitHub.