{"record":{"id":"28f3d05c4b673657","repo":"slackhq/nebula","slug":"no-inside-interface-tun","errorCode":null,"errorMessage":"no inside interface (tun)","messagePattern":"no inside interface \\(tun\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"interface.go","lineNumber":189,"sourceCode":"func (s recvErrorConfig) String() string {\n\tswitch s {\n\tcase recvErrorAlways:\n\t\treturn \"always\"\n\tcase recvErrorNever:\n\t\treturn \"never\"\n\tcase recvErrorPrivate:\n\t\treturn \"private\"\n\tdefault:\n\t\treturn fmt.Sprintf(\"invalid(%d)\", s)\n\t}\n}\n\nfunc NewInterface(ctx context.Context, c *InterfaceConfig) (*Interface, error) {\n\tif c.Outside == nil {\n\t\treturn nil, errors.New(\"no outside connection\")\n\t}\n\tif c.Inside == nil {\n\t\treturn nil, errors.New(\"no inside interface (tun)\")\n\t}\n\tif c.pki == nil {\n\t\treturn nil, errors.New(\"no certificate state\")\n\t}\n\tif c.Firewall == nil {\n\t\treturn nil, errors.New(\"no firewall rules\")\n\t}\n\tif c.connectionManager == nil {\n\t\treturn nil, errors.New(\"no connection manager\")\n\t}\n\n\tif c.routines <= 1 {\n\t\tc.PinThreads = false //pinning is not useful unless there's more than one tun reader\n\t}\n\n\tcs := c.pki.getCertState()\n\tifce := &Interface{\n\t\tctx:                   ctx,","sourceCodeStart":171,"sourceCodeEnd":207,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/interface.go#L171-L207","documentation":"Configuration guard in nebula.Main's NewInterface: the InterfaceConfig.Inside field (the tun device) is nil. NewInterface refuses to construct an Interface without an inside tunnel device since all packet flow depends on it.","triggerScenarios":"InterfaceConfig.Inside is nil because tun device creation failed or was skipped before NewInterface was called from Main.","commonSituations":"Missing /dev/net/tun or TUN module not loaded (Linux); missing admin privileges on Windows/macOS; invalid tun config (device name, routes); container without NET_ADMIN.","solutions":["Ensure the tun device is available (/dev/net/tun exists, kernel module loaded) and process has privileges","Check earlier logs for the tun creation error for the root cause","Fix tun section of config (dev name, mtu, routes)","Grant NET_ADMIN capability or run with required OS privileges"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if cfg.InterfaceConfig.Inside == nil {\n    return errors.New(\"tun device not created; check /dev/net/tun and privileges\")\n}","typeGuard":null,"tryCatchPattern":"i, err := NewInterface(ctx, c)\nif err != nil {\n    if err.Error() == \"no inside interface (tun)\" { /* fix tun creation: privileges, device, config */ }\n    return err\n}","preventionTips":["Verify /dev/net/tun exists and the process has NET_ADMIN before starting","Test tun device creation in your deployment environment (containers need --cap-add NET_ADMIN and /dev/net/tun)","Validate the tun config section (device name, mtu) at startup"],"tags":["network","config","tun","nebula","startup"],"backgroundTag":"missing-required-config","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}