{"record":{"id":"244104f0ecdacf83","repo":"slackhq/nebula","slug":"failed-to-set-ip-interface-w","errorCode":null,"errorMessage":"failed to set ip interface: %w","messagePattern":"failed to set ip interface: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"overlay/tun_windows.go","lineNumber":225,"sourceCode":"\t\t\tif r.Cidr.Bits() == 0 && r.Cidr.Addr().BitLen() == 32 {\n\t\t\t\tfoundDefault4 = true\n\t\t\t}\n\t\t}\n\t}\n\n\tipif, err := luid.IPInterface(windows.AF_INET)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to get ip interface: %w\", err)\n\t}\n\n\tipif.NLMTU = uint32(t.MTU)\n\tif foundDefault4 {\n\t\tipif.UseAutomaticMetric = false\n\t\tipif.Metric = 0\n\t}\n\n\tif err := ipif.Set(); err != nil {\n\t\treturn fmt.Errorf(\"failed to set ip interface: %w\", err)\n\t}\n\treturn nil\n}\n\nfunc (t *winTun) removeRoutes(routes []Route) error {\n\tluid := winipcfg.LUID(t.tun.LUID())\n\n\tfor _, r := range routes {\n\t\tif !r.Install {\n\t\t\tcontinue\n\t\t}\n\n\t\t// See comment on luid.AddRoute\n\t\terr := luid.DeleteRoute(r.Cidr, unspecifiedNextHop(r.Cidr))\n\t\tif err != nil {\n\t\t\tt.l.Error(\"Failed to remove route\", \"error\", err, \"route\", r)\n\t\t} else {\n\t\t\tt.l.Info(\"Removed route\", \"route\", r)","sourceCodeStart":207,"sourceCodeEnd":243,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/overlay/tun_windows.go#L207-L243","documentation":"addRoutes successfully read the IPv4 IP interface but ipif.Set() (applying NLMTU, metric, and forwarding flags) was rejected by Windows. The library wraps the winipcfg error to indicate the interface property update failed.","triggerScenarios":"ipif.Set() returns an error during Activate() or reload() — commonly when the interface is gone, or when setting UseAutomaticMetric=false/Metric=0 is denied because another process owns interface settings.","commonSituations":"Group policy or security software locking interface metrics; adapter removed mid-config; MTU value out of allowed range; concurrent route managers (other VPNs) fighting over the interface.","solutions":["Retry activation after confirming the adapter is present (often transient)","Check the configured MTU is reasonable (e.g. 1300-1400)","Stop other VPN clients or metric-override tools","Run as Administrator so interface property changes are permitted","Inspect the wrapped winipcfg error code for the exact NDIS/OS reason"],"exampleFix":"// before\ntun:\n  mtu: 9001\n// after\ntun:\n  mtu: 1300","handlingStrategy":"validation","validationCode":"mtu := cfg.Tun.MTU\nif mtu < 576 || mtu > 1400 {\n    return fmt.Errorf(\"MTU %d out of safe range for wintun\", mtu)\n}","typeGuard":null,"tryCatchPattern":"if err := tun.Activate(); err != nil {\n    if strings.Contains(err.Error(), \"failed to set ip interface\") {\n        // drop custom metric/MTU and retry activation\n    }\n    return err\n}","preventionTips":["Use a standard MTU (e.g. 1300)","Run as Administrator so interface settings apply","Don't run competing VPN clients that override metrics","Retry activation once; the failure is often transient"],"tags":["windows","routing","mtu","winipcfg"],"backgroundTag":"interface-configuration-failed","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}