{"record":{"id":"3f8725c2c29e81c7","repo":"slackhq/nebula","slug":"errpeerrejected","errorCode":"ErrPeerRejected","errorMessage":"remote address is not within a network that we handle","messagePattern":"remote address is not within a network that we handle","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"firewall.go","lineNumber":419,"sourceCode":"\t\tif warning := r.sanity(); warning != nil {\n\t\t\tl.Warn(\"firewall rule sanity check\",\n\t\t\t\t\"table\", table,\n\t\t\t\t\"rule\", i,\n\t\t\t\t\"warning\", warning,\n\t\t\t)\n\t\t}\n\n\t\terr = fw.AddRule(inbound, proto, startPort, endPort, r.Groups, r.Host, r.Cidr, r.LocalCidr, r.CAName, r.CASha)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"%s rule #%v; `%s`\", table, i, err)\n\t\t}\n\t}\n\n\treturn nil\n}\n\nvar ErrUnknownNetworkType = errors.New(\"unknown network type\")\nvar ErrPeerRejected = errors.New(\"remote address is not within a network that we handle\")\nvar ErrInvalidRemoteIP = errors.New(\"remote address is not in remote certificate networks\")\nvar ErrInvalidLocalIP = errors.New(\"local address is not in list of handled local addresses\")\nvar ErrNoMatchingRule = errors.New(\"no matching rule in firewall table\")\n\n// Drop returns an error if the packet should be dropped, explaining why. It\n// returns nil if the packet should not be dropped.\nfunc (f *Firewall) Drop(fp firewall.Packet, incoming bool, h *HostInfo, caPool *cert.CAPool, localCache firewall.ConntrackCache) error {\n\t// Make sure remote address matches nebula certificate, and determine how to treat it\n\tif h.networks == nil {\n\t\t// Simple case: Certificate has one address and no unsafe networks\n\t\tif h.vpnAddrs[0] != fp.RemoteAddr {\n\t\t\tf.metrics(incoming).droppedRemoteAddr.Inc(1)\n\t\t\treturn ErrInvalidRemoteIP\n\t\t}\n\t} else {\n\t\tnwType, ok := h.networks.Lookup(fp.RemoteAddr)\n\t\tif !ok {\n\t\t\tf.metrics(incoming).droppedRemoteAddr.Inc(1)","sourceCodeStart":401,"sourceCodeEnd":437,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/firewall.go#L401-L437","documentation":"ErrPeerRejected is a sentinel error declared in firewall.go (firewall.go:419) with message \"remote address is not within a network that we handle\". Firewall.Drop returns it when the remote host's IP resolves to a network of type NetworkTypeVPNPeer: the peer is authenticated but its traffic is not accepted by any firewall rule path yet, so all packets from such peers are dropped. The code comments note this is provisional — VPN-peer networks may one day get their own firewall rule treatment, but currently they are unconditionally rejected.","triggerScenarios":"Calling Firewall.Drop on a packet whose HostInfo remote address falls into a prefix classified as NetworkTypeVPNPeer in the firewall's network table (firewall.go:445), i.e. a peer whose cert networks map to the VPN-peer network type rather than a regular host/unsafe network.","commonSituations":"Deployments where peers are provisioned with certificates containing network/CIDR entries that the local node classifies as NetworkTypeVPNPeer; mixing node types or configurations where one Nebula node treats another's address space as 'vpn peer' range; staged rollouts where the peer-network firewall feature is not yet implemented.","solutions":["Check which network type the remote address maps to in the firewall's networks table and reclassify it (e.g. via certificate networks/config) so it is not NetworkTypeVPNPeer","Ensure the remote peer's certificate networks list the specific host CIDR the node expects instead of a broad VPN-peer prefix","Upgrade or patch nebula if you need VPN-peer traffic support; today the code intentionally drops these packets (see comment at firewall.go:445)","Verify tunnel setup: if both sides classify each other as VPNPeer, renegotiate certs so addresses fall into handled networks"],"exampleFix":"// before: remote cert declares a broad peer network classified as NetworkTypeVPNPeer\n//   cert networks: [\"10.100.0.0/16\" (vpn-peer)]\n// after: declare the specific host range the local node handles\n//   cert networks: [\"10.100.1.0/24\"]  // falls into a handled network type, Drop proceeds past the NetworkTypeVPNPeer case","handlingStrategy":"validation","validationCode":"// before relying on traffic, confirm how the firewall classifies the remote address\nif fw.GetNetworkType(remoteAddr) == NetworkTypeVPNPeer {\n    // address will be rejected by Drop (firewall.go:445); reconfigure cert networks first\n}","typeGuard":null,"tryCatchPattern":"// nebula returns error values, not panics\nif err := fw.Drop(pkt, incoming, host, caPool, cache); err != nil {\n    if errors.Is(err, firewall.ErrPeerRejected) {\n        // peer classified as NetworkTypeVPNPeer: fix cert networks or wait for peer-rule support\n    }\n}","preventionTips":["Keep peer certificates listing only networks the receiving node can classify as regular handled networks","Avoid issuing certs whose networks overlap the designated VPN-peer range unless peer firewall rules are supported in your build","Review the network-type classification of your CIDR plan before rollout"],"tags":["firewall","packet-drop","vpn-peer","nebula"],"backgroundTag":"packet-dropped-by-firewall","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}