{"record":{"id":"6d75d46cfbb20f1f","repo":"slackhq/nebula","slug":"failed-to-set-route-for-vpn-network-v-w","errorCode":null,"errorMessage":"failed to set route for vpn network %v: %w","messagePattern":"failed to set route for vpn network (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"overlay/tun_openbsd.go","lineNumber":256,"sourceCode":"\t\treq.MaskAddr = unix.RawSockaddrInet4{\n\t\t\tLen:    unix.SizeofSockaddrInet4,\n\t\t\tFamily: unix.AF_INET,\n\t\t\tAddr:   prefixToMask(cidr).As4(),\n\t\t}\n\n\t\ts, err := unix.Socket(unix.AF_INET, unix.SOCK_DGRAM, unix.IPPROTO_IP)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tdefer syscall.Close(s)\n\n\t\tif err := ioctl(uintptr(s), unix.SIOCAIFADDR, uintptr(unsafe.Pointer(&req))); err != nil {\n\t\t\treturn fmt.Errorf(\"failed to set tun address %s: %s\", cidr.Addr(), err)\n\t\t}\n\n\t\terr = addRoute(cidr, t.vpnNetworks)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to set route for vpn network %v: %w\", cidr, err)\n\t\t}\n\n\t\treturn nil\n\t}\n\n\tif cidr.Addr().Is6() {\n\t\tvar req ifreqAlias6\n\t\treq.Name = t.deviceBytes()\n\t\treq.Addr = unix.RawSockaddrInet6{\n\t\t\tLen:    unix.SizeofSockaddrInet6,\n\t\t\tFamily: unix.AF_INET6,\n\t\t\tAddr:   cidr.Addr().As16(),\n\t\t}\n\t\treq.PrefixMask = unix.RawSockaddrInet6{\n\t\t\tLen:    unix.SizeofSockaddrInet6,\n\t\t\tFamily: unix.AF_INET6,\n\t\t\tAddr:   prefixToMask(cidr).As16(),\n\t\t}","sourceCodeStart":238,"sourceCodeEnd":274,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/overlay/tun_openbsd.go#L238-L274","documentation":"After successfully assigning the address, addIp calls addRoute to install a kernel route for the vpn network. If addRoute fails (socket creation or route message rejected), the error is wrapped with this message. The address is set but routing is not, so the tunnel will not pass traffic.","triggerScenarios":"IPv4 addIp where addRoute returns an error — e.g. AF_ROUTE socket creation failed due to privileges, or the kernel rejected RTM_ADD (EEXIST, EINVAL, unreachable gateway).","commonSituations":"Route already present from a previous run; non-root process lacking route table access; conflicting routes from other VPN software.","solutions":["Check the wrapped addRoute error for the kernel reason (EEXIST means route already present — safe to delete stale route)","Run with sufficient privileges to modify the routing table","Remove conflicting/stale routes: `route delete <vpn-net>`","Ensure the vpn networks in config match the certificate networks"],"exampleFix":"# before (stale route)\n$ route -n get 10.0.0.0/24\n# after\n$ doas route delete 10.0.0.0/24 && doas ./nebula -config config.yaml","handlingStrategy":"try-catch","validationCode":"out, _ := exec.Command(\"route\", \"-n\", \"show\").Output()\nif strings.Contains(string(out), vpnNet.String()) {\n    log.Warn(\"route already present; removing stale route\", \"net\", vpnNet)\n}","typeGuard":null,"tryCatchPattern":"err := t.Activate()\nif err != nil && strings.Contains(err.Error(), \"failed to set route for vpn network\") {\n    if strings.Contains(err.Error(), \"File exists\") {\n        // delete stale route and retry once\n    }\n    return err\n}","preventionTips":["Clean stale routes from previous runs before starting","Avoid running multiple VPN daemons claiming the same networks","Keep config networks aligned with certificate networks"],"tags":["openbsd","tun","route","ipv4","routing"],"backgroundTag":"route-add-failed","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}