{"record":{"id":"3ea5498f5f72884c","repo":"slackhq/nebula","slug":"entry-v-route-in-tun-routes-is-not-contained-with","errorCode":null,"errorMessage":"entry %v.route in tun.routes is not contained within the configured vpn networks; route: %v, networks: %v","messagePattern":"entry (.+?)\\.route in tun\\.routes is not contained within the configured vpn networks; route: (.+?), networks: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"overlay/route.go","lineNumber":135,"sourceCode":"\t\t\tInstall: true,\n\t\t\tMTU:     mtu,\n\t\t}\n\n\t\tr.Cidr, err = netip.ParsePrefix(fmt.Sprintf(\"%v\", rRoute))\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"entry %v.route in tun.routes failed to parse: %v\", i+1, err)\n\t\t}\n\n\t\tfound := false\n\t\tfor _, network := range networks {\n\t\t\tif network.Contains(r.Cidr.Addr()) && r.Cidr.Bits() >= network.Bits() {\n\t\t\t\tfound = true\n\t\t\t\tbreak\n\t\t\t}\n\t\t}\n\n\t\tif !found {\n\t\t\treturn nil, fmt.Errorf(\n\t\t\t\t\"entry %v.route in tun.routes is not contained within the configured vpn networks; route: %v, networks: %v\",\n\t\t\t\ti+1,\n\t\t\t\tr.Cidr.String(),\n\t\t\t\tnetworks,\n\t\t\t)\n\t\t}\n\n\t\troutes[i] = r\n\t}\n\n\treturn routes, nil\n}\n\nfunc parseUnsafeRoutes(c *config.C, networks []netip.Prefix) ([]Route, error) {\n\tvar err error\n\n\tr := c.Get(\"tun.unsafe_routes\")\n\tif r == nil {","sourceCodeStart":117,"sourceCodeEnd":153,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/overlay/route.go#L117-L153","documentation":"The parsed route CIDR is valid but not contained within any of the configured VPN networks for this host. parseRoutes checks each route against the host's allowed networks (network.Contains(cidr.Addr()) && cidr.Bits() >= network.Bits()) and rejects routes that would reach outside the VPN's address space, listing the route and the allowed networks.","triggerScenarios":"getAllRoutesFromConfig reads a tun.routes entry whose CIDR falls outside (or is broader than) the networks configured for the host/certificate, e.g. route 192.168.1.0/24 when the VPN only covers 10.0.0.0/24, or route 10.0.0.0/8 when the host network is 10.0.1.0/24 (route broader than the allowed network).","commonSituations":"Operator wants to route additional corporate subnets but forgot to add them to the host's allowed networks; copy-pasting routes from another nebula/overlay deployment; prefix-length mistakes making the route broader than the network; intentional route escalation that the config correctly rejects as a security guard.","solutions":["Add the desired network to the host's configured vpn networks (its allowed networks in the CA/certificate or networks list) so the route is contained","Narrow the route to fit within an already-configured network (e.g. 10.0.1.0/24 instead of 10.0.0.0/8)","Compare the printed route against the printed networks list to see the containment mismatch","If routing beyond the VPN is genuinely needed, update the certificate/host network configuration first — never try to bypass this check"],"exampleFix":"// before: host networks = 10.0.0.0/24, route outside it\nroutes:\n  - mtu: 1300\n    route: 192.168.1.0/24\n// after: either change route to fit, or extend host networks\ntun:\n  routes:\n    - mtu: 1300\n      route: 10.0.0.0/24","handlingStrategy":"validation","validationCode":"cidr := netip.MustParsePrefix(fmt.Sprintf(\"%v\", m[\"route\"]))\ncontained := false\nfor _, n := range networks {\n    if n.Contains(cidr.Addr()) && cidr.Bits() >= n.Bits() {\n        contained = true\n        break\n    }\n}\nif !contained {\n    return fmt.Errorf(\"route %s not within configured vpn networks %v\", cidr, networks)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Before adding a route, confirm its CIDR is inside a configured vpn network for the host","Route prefix must be equal to or longer (more specific) than the network prefix","When adding new subnets, update host/certificate networks first","Keep host network definitions and tun.routes in sync through review/CI checks"],"tags":["config","validation","routing"],"backgroundTag":"route-outside-allowed-networks","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}