{"record":{"id":"06d584ce62343124","repo":"slackhq/nebula","slug":"errinvalidlocalip","errorCode":"ErrInvalidLocalIP","errorMessage":"local address is not in list of handled local addresses","messagePattern":"local address is not in list of handled local addresses","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"firewall.go","lineNumber":421,"sourceCode":"\t\t\t\t\"table\", table,\n\t\t\t\t\"rule\", i,\n\t\t\t\t\"warning\", warning,\n\t\t\t)\n\t\t}\n\n\t\terr = fw.AddRule(inbound, proto, startPort, endPort, r.Groups, r.Host, r.Cidr, r.LocalCidr, r.CAName, r.CASha)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"%s rule #%v; `%s`\", table, i, err)\n\t\t}\n\t}\n\n\treturn nil\n}\n\nvar ErrUnknownNetworkType = errors.New(\"unknown network type\")\nvar ErrPeerRejected = errors.New(\"remote address is not within a network that we handle\")\nvar ErrInvalidRemoteIP = errors.New(\"remote address is not in remote certificate networks\")\nvar ErrInvalidLocalIP = errors.New(\"local address is not in list of handled local addresses\")\nvar ErrNoMatchingRule = errors.New(\"no matching rule in firewall table\")\n\n// Drop returns an error if the packet should be dropped, explaining why. It\n// returns nil if the packet should not be dropped.\nfunc (f *Firewall) Drop(fp firewall.Packet, incoming bool, h *HostInfo, caPool *cert.CAPool, localCache firewall.ConntrackCache) error {\n\t// Make sure remote address matches nebula certificate, and determine how to treat it\n\tif h.networks == nil {\n\t\t// Simple case: Certificate has one address and no unsafe networks\n\t\tif h.vpnAddrs[0] != fp.RemoteAddr {\n\t\t\tf.metrics(incoming).droppedRemoteAddr.Inc(1)\n\t\t\treturn ErrInvalidRemoteIP\n\t\t}\n\t} else {\n\t\tnwType, ok := h.networks.Lookup(fp.RemoteAddr)\n\t\tif !ok {\n\t\t\tf.metrics(incoming).droppedRemoteAddr.Inc(1)\n\t\t\treturn ErrInvalidRemoteIP\n\t\t}","sourceCodeStart":403,"sourceCodeEnd":439,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/firewall.go#L403-L439","documentation":"ErrInvalidLocalIP is a sentinel error declared at firewall.go:421 with message \"local address is not in list of handled local addresses\". Firewall.Drop returns it when the packet's destination (local) address is not contained in the firewall's routableNetworks set (firewall.go:457), meaning the packet is not addressed to any IP this node is configured to handle. This protects against packets destined to addresses the node does not own or route.","triggerScenarios":"Firewall.Drop is called with a firewall.Packet whose fp.LocalAddr (destination IP) is outside the prefix set configured as the node's routable networks (f.routableNetworks.Contains fails). See firewall.go:457 and the test at firewall_test.go:1645 where LocalAddr is forced to 1.2.3.8.","commonSituations":"Wrong 'listen host' / tun route setup where the node's tun interface address is not among handled networks; packets routed to the node for forwarding that it is not configured to accept; typos in config networks; sending to an old node IP after re-addressing without updating routable networks; test harnesses constructing packets with arbitrary LocalAddr values.","solutions":["Add the destination network to the node's handled/routable networks config so f.routableNetworks contains fp.LocalAddr","Fix the packet generation/dialing side to use the node's actual configured address as destination","Verify the tun interface and nebula config agree on the node's address after re-addressing","If this is a forwarding/relay setup, explicitly configure the relayed networks as routable"],"exampleFix":"// before (test-style packet with bogus destination)\ntc.p.LocalAddr = netip.MustParseAddr(\"1.2.3.8\") // not in routableNetworks\n// after\ntc.p.LocalAddr = myAddr // an address contained in the node's handled local prefixes","handlingStrategy":"validation","validationCode":"// ensure the destination is in the node's handled local networks before sending/Drop\nfunc localAddrOK(routable *netipx.IPSet, local netip.Addr) bool {\n    return routable.Contains(local)\n}","typeGuard":null,"tryCatchPattern":"if err := fw.Drop(pkt, incoming, host, caPool, cache); err != nil {\n    if errors.Is(err, firewall.ErrInvalidLocalIP) {\n        // packet is addressed outside handled local networks: fix destination or routable config\n    }\n}","preventionTips":["Keep the node's tun address and configured routable networks in sync after any re-addressing","Only construct packets to addresses the node advertises as its own","When relaying/forwarding, explicitly add the relayed ranges to the handled networks","In tests, derive packet LocalAddr from the setup's prefix rather than hardcoding unrelated IPs"],"tags":["firewall","routing","configuration","packet-drop"],"backgroundTag":"destination-not-routable","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}