{"record":{"id":"33172a8327d8c449","repo":"slackhq/nebula","slug":"failed-to-get-tun-flags-s","errorCode":null,"errorMessage":"failed to get tun flags: %s","messagePattern":"failed to get tun flags: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"overlay/tun_darwin.go","lineNumber":188,"sourceCode":"\t\tunix.IPPROTO_IP,\n\t)\n\tif err != nil {\n\t\treturn err\n\t}\n\tdefer unix.Close(s)\n\n\tfd := uintptr(s)\n\n\t// Set the MTU on the device\n\tifm := ifreqMTU{Name: devName, MTU: int32(t.DefaultMTU)}\n\tif err = ioctl(fd, unix.SIOCSIFMTU, uintptr(unsafe.Pointer(&ifm))); err != nil {\n\t\treturn fmt.Errorf(\"failed to set tun mtu: %v\", err)\n\t}\n\n\t// Get the device flags\n\tifrf := ifReq{Name: devName}\n\tif err = ioctl(fd, unix.SIOCGIFFLAGS, uintptr(unsafe.Pointer(&ifrf))); err != nil {\n\t\treturn fmt.Errorf(\"failed to get tun flags: %s\", err)\n\t}\n\n\tlinkAddr, err := getLinkAddr(t.Device)\n\tif err != nil {\n\t\treturn err\n\t}\n\tif linkAddr == nil {\n\t\treturn fmt.Errorf(\"unable to discover link_addr for tun interface\")\n\t}\n\tt.linkAddr = linkAddr\n\n\tfor _, network := range t.vpnNetworks {\n\t\tif network.Addr().Is4() {\n\t\t\terr = t.activate4(network)\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t} else {","sourceCodeStart":170,"sourceCodeEnd":206,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/overlay/tun_darwin.go#L170-L206","documentation":"Right after setting the MTU, Activate reads the interface flags with the SIOCGIFFLAGS ioctl to learn the device state before configuring routes/addresses. If that ioctl fails, the errno is wrapped in this error. It usually indicates the interface does not exist or the caller lacks privilege to query it.","triggerScenarios":"ioctl(fd, SIOCGIFFLAGS, ifReq{devName}) fails during tun.Activate — devName not present in the interface table, fd not a valid control socket for that device, or permission denial.","commonSituations":"tun.dev configured with a name that was never created; interface destroyed between connect and activate (competing VPN); running without sufficient privileges in restricted macOS environments.","solutions":["Confirm the interface exists: `ifconfig <devName>`; fix tun.dev if it does not.","Run with root privileges so interface ioctls are allowed.","Ensure no other VPN tool is deleting/recreating the utun while nebula activates; stop competing VPNs.","Restart nebula so a fresh utun is created and activated atomically."],"exampleFix":"// before (nebula.yml)\ntun:\n  dev: utun99   # never created / wrong name\n// after\ntun:\n  dev: utun50   # or omit dev so nebula uses the name it just created","handlingStrategy":"validation","validationCode":"out, err := exec.Command(\"ifconfig\", devName).Output()\nif err != nil || len(out) == 0 {\n    return fmt.Errorf(\"interface %s does not exist before activate\", devName)\n}","typeGuard":null,"tryCatchPattern":"if err := start(); err != nil && strings.Contains(err.Error(), \"failed to get tun flags\") {\n    // interface missing or permission denied: check ifconfig and privileges\n}","preventionTips":["Confirm the device exists with `ifconfig <dev>` before activation","Run with root privileges so interface ioctls succeed","Stop other VPN clients that destroy utun devices concurrently"],"tags":["macos","darwin","ioctl","interface-flags","permissions"],"backgroundTag":"interface-ioctl-failed","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}