{"record":{"id":"6c8e31224d43da1a","repo":"slackhq/nebula","slug":"unknown-tun-network-category-q-expected-public","errorCode":null,"errorMessage":"unknown tun.network_category %q (expected public, private, domain, or unset)","messagePattern":"unknown tun\\.network_category %q \\(expected public, private, domain, or unset\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"overlay/network_category_windows.go","lineNumber":53,"sourceCode":"\t\treturn \"domain\"\n\t}\n\treturn fmt.Sprintf(\"unknown(%d)\", c)\n}\n\n// parseNetworkCategory accepts the user-supplied tun.network_category. A\n// second return of false means \"leave the category alone\".\nfunc parseNetworkCategory(s string) (networkCategory, bool, error) {\n\tswitch strings.ToLower(strings.TrimSpace(s)) {\n\tcase \"\", \"unset\":\n\t\treturn 0, false, nil\n\tcase \"public\":\n\t\treturn networkCategoryPublic, true, nil\n\tcase \"private\":\n\t\treturn networkCategoryPrivate, true, nil\n\tcase \"domain\", \"domainauthenticated\":\n\t\treturn networkCategoryDomainAuthenticated, true, nil\n\t}\n\treturn 0, false, fmt.Errorf(\"unknown tun.network_category %q (expected public, private, domain, or unset)\", s)\n}\n\n// CLSID_NetworkListManager {DCB00C01-570F-4A9B-8D69-199FDBA5723B}\nvar clsidNetworkListManager = windows.GUID{\n\tData1: 0xDCB00C01, Data2: 0x570F, Data3: 0x4A9B,\n\tData4: [8]byte{0x8D, 0x69, 0x19, 0x9F, 0xDB, 0xA5, 0x72, 0x3B},\n}\n\n// IID_INetworkListManager {DCB00000-570F-4A9B-8D69-199FDBA5723B}\nvar iidINetworkListManager = windows.GUID{\n\tData1: 0xDCB00000, Data2: 0x570F, Data3: 0x4A9B,\n\tData4: [8]byte{0x8D, 0x69, 0x19, 0x9F, 0xDB, 0xA5, 0x72, 0x3B},\n}\n\n// x/sys/windows doesn't expose CoCreateInstance, so we bind it ourselves.\nvar procCoCreateInstance = windows.NewLazySystemDLL(\"ole32.dll\").NewProc(\"CoCreateInstance\")\n\nconst clsCtxAll = windows.CLSCTX_INPROC_SERVER | windows.CLSCTX_INPROC_HANDLER |","sourceCodeStart":35,"sourceCodeEnd":71,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/overlay/network_category_windows.go#L35-L71","documentation":"parseNetworkCategory returns this error when the tun.network_category config value is a non-empty string that is not one of the accepted values: public, private, domain, or domainauthenticated (case-insensitive per the switch). The empty/unset string is treated as 'not set' and returns ok=false without error, so this error only fires for explicitly wrong values.","triggerScenarios":"Starting a Nebula tunnel on Windows with a tun.network_category setting containing a typo or unsupported value such as 'Public ', 'domian', 'DomainAuth', or a localized network profile name.","commonSituations":"Copy-pasting the Windows network profile name (e.g. 'Network 2') instead of the category keyword; case/spacing mistakes; following outdated documentation that used a different keyword; editing YAML with an unquoted value that got mangled.","solutions":["Set tun.network_category to exactly one of: public, private, domain, domainauthenticated — or remove the key entirely to leave it unset","Trim whitespace and quotes around the value in the config file","Check for YAML type coercion (e.g. an unquoted value being altered); quote the string","Update the config template/docs on the machine to the current accepted keywords"],"exampleFix":"// before (config)\ntun:\n  network_category: Domian\n// after\ntun:\n  network_category: domain","handlingStrategy":"validation","validationCode":"var validCategories = map[string]bool{\n    \"public\": true, \"private\": true,\n    \"domain\": true, \"domainauthenticated\": true,\n}\nfunc validateCategory(s string) error {\n    s = strings.ToLower(strings.TrimSpace(s))\n    if s == \"\" || validCategories[s] {\n        return nil\n    }\n    return fmt.Errorf(\"tun.network_category %q invalid\", s)\n}","typeGuard":null,"tryCatchPattern":"cat, ok, err := parseNetworkCategory(cfg.Tun.NetworkCategory)\nif err != nil {\n    return fmt.Errorf(\"fix tun.network_category in config (%v)\", err)\n}","preventionTips":["Only use the documented keywords: public, private, domain, domainauthenticated","Quote the value in YAML to avoid parser coercion","Trim whitespace after editing configs","Remove the key entirely if you want the OS default behavior"],"tags":["windows","configuration","tun","network-category"],"backgroundTag":"invalid-config-value","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}