{"record":{"id":"4a7de536313806e8","repo":"cloudflare/cloudflared","slug":"unable-to-create-ip-access-policy-for-s-s","errorCode":null,"errorMessage":"unable to create ip access policy for %s: %s","messagePattern":"unable to create ip access policy for (.+?): (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"ingress/ingress.go","lineNumber":283,"sourceCode":"\t\t\t}\n\t\t\tsrv := newStatusCode(statusCode)\n\t\t\tservice = &srv\n\t\t} else if r.Service == HelloWorldFlag || r.Service == HelloWorldService {\n\t\t\tservice = new(helloWorld)\n\t\t} else if r.Service == ServiceSocksProxy {\n\t\t\trules := make([]ipaccess.Rule, len(r.OriginRequest.IPRules))\n\n\t\t\tfor i, ipRule := range r.OriginRequest.IPRules {\n\t\t\t\trule, err := ipaccess.NewRuleByCIDR(ipRule.Prefix, ipRule.Ports, ipRule.Allow)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn Ingress{}, fmt.Errorf(\"unable to create ip rule for %s: %s\", r.Service, err)\n\t\t\t\t}\n\t\t\t\trules[i] = rule\n\t\t\t}\n\n\t\t\taccessPolicy, err := ipaccess.NewPolicy(false, rules)\n\t\t\tif err != nil {\n\t\t\t\treturn Ingress{}, fmt.Errorf(\"unable to create ip access policy for %s: %s\", r.Service, err)\n\t\t\t}\n\n\t\t\tservice = newSocksProxyOverWSService(accessPolicy)\n\t\t} else if r.Service == ServiceBastion || cfg.BastionMode {\n\t\t\t// Bastion mode will always start a Websocket proxy server, which will\n\t\t\t// overwrite the localService.URL field when `start` is called. So,\n\t\t\t// leave the URL field empty for now.\n\t\t\tcfg.BastionMode = true\n\t\t\tservice = newBastionService()\n\t\t} else {\n\t\t\t// Validate URL services\n\t\t\tu, err := url.Parse(r.Service)\n\t\t\tif err != nil {\n\t\t\t\treturn Ingress{}, err\n\t\t\t}\n\n\t\t\tif u.Scheme == \"\" || u.Hostname() == \"\" {\n\t\t\t\treturn Ingress{}, fmt.Errorf(\"%s is an invalid address, please make sure it has a scheme and a hostname\", r.Service)","sourceCodeStart":265,"sourceCodeEnd":301,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/ingress/ingress.go#L265-L301","documentation":"After building individual ipaccess.Rules for a socks-proxy ingress service, validateIngress assembles them into an ipaccess.Policy with NewPolicy(false, rules). If policy construction fails (e.g. no rules provided), this wrapped error is returned and the ingress rule is rejected.","triggerScenarios":"UnmarshalJSON/ParseIngress with `service: socks-proxy` where ipaccess.NewPolicy returns an error — typically when the ipRules list is empty or internally inconsistent after per-rule validation passed.","commonSituations":"A socks-proxy rule with no ipRules defined at all, or config where rules were filtered out leaving an empty set the policy rejects.","solutions":["Provide at least one valid ipRules entry under originRequest for the socks-proxy service","Check the underlying NewPolicy error message (embedded after the service name) for the exact cause","Verify the config file section parses as a list, not a scalar"],"exampleFix":"// before\nservice: socks-proxy\n// (no originRequest.ipRules)\n// after\nservice: socks-proxy\noriginRequest:\n  ipRules:\n    - prefix: 0.0.0.0/0\n      allow: true","handlingStrategy":"validation","validationCode":"if svc == \"socks-proxy\" && len(ipRules) == 0 {\n\treturn errors.New(\"socks-proxy requires at least one ipRule\")\n}","typeGuard":null,"tryCatchPattern":"if err := ingress.ParseIngress(cfg); err != nil {\n\tif strings.Contains(err.Error(), \"unable to create ip access policy\") {\n\t\t// inspect embedded cause and fix ipRules/policy inputs\n\t}\n\treturn err\n}","preventionTips":["Always define at least one ipRule with socks-proxy","Unit-test config parsing before rollout"],"tags":["ingress","ip-access","socks-proxy"],"backgroundTag":"invalid-config-value","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}