{"record":{"id":"09d82b8060a69cf3","repo":"cloudflare/cloudflared","slug":"unable-to-create-ip-rule-for-s-s","errorCode":null,"errorMessage":"unable to create ip rule for %s: %s","messagePattern":"unable to create ip rule for (.+?): (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"ingress/ingress.go","lineNumber":276,"sourceCode":"\t\t} else if prefix := \"http_status:\"; strings.HasPrefix(r.Service, prefix) {\n\t\t\tstatusCode, err := strconv.Atoi(strings.TrimPrefix(r.Service, prefix))\n\t\t\tif err != nil {\n\t\t\t\treturn Ingress{}, errors.Wrap(err, \"invalid HTTP status code\")\n\t\t\t}\n\t\t\tif statusCode < 100 || statusCode > 999 {\n\t\t\t\treturn Ingress{}, fmt.Errorf(\"invalid HTTP status code: %d\", statusCode)\n\t\t\t}\n\t\t\tsrv := newStatusCode(statusCode)\n\t\t\tservice = &srv\n\t\t} else if r.Service == HelloWorldFlag || r.Service == HelloWorldService {\n\t\t\tservice = new(helloWorld)\n\t\t} else if r.Service == ServiceSocksProxy {\n\t\t\trules := make([]ipaccess.Rule, len(r.OriginRequest.IPRules))\n\n\t\t\tfor i, ipRule := range r.OriginRequest.IPRules {\n\t\t\t\trule, err := ipaccess.NewRuleByCIDR(ipRule.Prefix, ipRule.Ports, ipRule.Allow)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn Ingress{}, fmt.Errorf(\"unable to create ip rule for %s: %s\", r.Service, err)\n\t\t\t\t}\n\t\t\t\trules[i] = rule\n\t\t\t}\n\n\t\t\taccessPolicy, err := ipaccess.NewPolicy(false, rules)\n\t\t\tif err != nil {\n\t\t\t\treturn Ingress{}, fmt.Errorf(\"unable to create ip access policy for %s: %s\", r.Service, err)\n\t\t\t}\n\n\t\t\tservice = newSocksProxyOverWSService(accessPolicy)\n\t\t} else if r.Service == ServiceBastion || cfg.BastionMode {\n\t\t\t// Bastion mode will always start a Websocket proxy server, which will\n\t\t\t// overwrite the localService.URL field when `start` is called. So,\n\t\t\t// leave the URL field empty for now.\n\t\t\tcfg.BastionMode = true\n\t\t\tservice = newBastionService()\n\t\t} else {\n\t\t\t// Validate URL services","sourceCodeStart":258,"sourceCodeEnd":294,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/ingress/ingress.go#L258-L294","documentation":"When an ingress rule's service is the SOCKS proxy, each entry under originRequest.ipRules is converted into an ipaccess.Rule via NewRuleByCIDR. If any rule fails to build (nil/empty prefix or malformed CIDR), validateIngress wraps the error with the service name and rejects the whole ingress config.","triggerScenarios":"UnmarshalJSON or ParseIngress on a rule with `service: socks-proxy` where originRequest.ipRules contains a bad entry (empty prefix or unparseable CIDR string), causing ipaccess.NewRuleByCIDR to return an error.","commonSituations":"CIDR typos like `10.0.0.0/33` or `192.168.1/24` variants, missing `prefix` key in an ipRules entry, or YAML indentation mistakes that yield empty prefixes.","solutions":["Fix the offending ipRule: give each entry a valid CIDR prefix (e.g. `10.0.0.0/8`) and valid ports","Validate each prefix with net.ParseCIDR or an online CIDR checker before deploying","Ensure YAML structure is correct so prefix fields are populated, not nil"],"exampleFix":"// before\noriginRequest:\n  ipRules:\n    - prefix: 10.0.0.0/33\n      allow: true\n// after\noriginRequest:\n  ipRules:\n    - prefix: 10.0.0.0/8\n      allow: true","handlingStrategy":"validation","validationCode":"for _, r := range ipRules {\n\tif _, _, err := net.ParseCIDR(r.Prefix); err != nil {\n\t\treturn fmt.Errorf(\"bad ip rule prefix %q: %w\", r.Prefix, err)\n\t}\n}","typeGuard":null,"tryCatchPattern":"var ing ingress.Ingress\nif err := json.Unmarshal(data, &ing); err != nil {\n\tif strings.Contains(err.Error(), \"unable to create ip rule\") {\n\t\t// log the failing service + fix the ipRules entry in config\n\t}\n\treturn err\n}","preventionTips":["Validate all CIDR entries in CI config linting","Never leave prefix fields empty in ipRules","Use schema validation for the config file"],"tags":["ingress","ip-access","socks-proxy","cidr"],"backgroundTag":"invalid-config-value","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}