{"record":{"id":"70702948bc973aca","repo":"hashicorp/nomad","slug":"consul-connect-transparent-proxy-cannot-be-used-wi","errorCode":null,"errorMessage":"Consul Connect transparent proxy cannot be used with network.dns unless no_dns=true","messagePattern":"Consul Connect transparent proxy cannot be used with network\\.dns unless no_dns=true","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/job_endpoint_hook_connect.go","lineNumber":599,"sourceCode":"\t\t\t\tif up.LocalBindSocketPath == \"\" {\n\t\t\t\t\tlistener = net.JoinHostPort(up.LocalBindAddress, strconv.Itoa(up.LocalBindPort))\n\t\t\t\t} else {\n\t\t\t\t\tlistener = up.LocalBindSocketPath\n\t\t\t\t}\n\t\t\t\tif s, exists := listeners[listener]; exists {\n\t\t\t\t\treturn fmt.Errorf(\n\t\t\t\t\t\t\"Consul Connect services %q and %q in group %q using same address for upstreams (%s)\",\n\t\t\t\t\t\tservice.Name, s, g.Name, listener,\n\t\t\t\t\t)\n\t\t\t\t}\n\t\t\t\tlisteners[listener] = service.Name\n\t\t\t}\n\n\t\t\tif tp := service.Connect.SidecarService.Proxy.TransparentProxy; tp != nil {\n\t\t\t\thasTproxy = true\n\t\t\t\tfor _, net := range g.Networks {\n\t\t\t\t\tif !net.DNS.IsZero() && !tp.NoDNS {\n\t\t\t\t\t\treturn fmt.Errorf(\n\t\t\t\t\t\t\t\"Consul Connect transparent proxy cannot be used with network.dns unless no_dns=true\")\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tfor _, portLabel := range tp.ExcludeInboundPorts {\n\t\t\t\t\tif !transparentProxyPortLabelValidate(g, portLabel) {\n\t\t\t\t\t\treturn fmt.Errorf(\n\t\t\t\t\t\t\t\"Consul Connect transparent proxy port %q must be numeric or one of network.port labels\", portLabel)\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\n\t\t}\n\t}\n\tif hasTproxy && connectBlockCount > 1 {\n\t\treturn fmt.Errorf(\"Consul Connect transparent proxy requires there is only one connect block\")\n\t}\n\treturn nil\n}","sourceCodeStart":581,"sourceCodeEnd":617,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/job_endpoint_hook_connect.go#L581-L617","documentation":"When a Connect service configures a transparent proxy (`transparent_proxy {}`), the sidecar intercepts all traffic, which conflicts with task-group `network { dns {...} }` settings unless the user explicitly opts out with `no_dns = true`. Nomad's groupConnectUpstreamsValidate hook returns this error at job validation time when a network block has DNS servers/options and the transparent proxy does not set NoDNS.","triggerScenarios":"Job submission (validate/plan/run) where for some service in the group, `connect.sidecar_service.proxy.transparent_proxy` is set, a network in `g.Networks` has a non-zero `dns` block, and `transparent_proxy.no_dns` is not true.","commonSituations":"Adding a transparent proxy to an existing group that already configured custom DNS servers for the group's bridge network; templates converted from Consul config entries where DNS coexistence was allowed; users unaware the sidecar's iptables interception overrides group DNS settings.","solutions":["Set `no_dns = true` inside the `transparent_proxy {}` block to acknowledge DNS is handled separately.","Remove the `dns` block from the group's `network` stanza since transparent proxy traffic will not honor it.","Drop `transparent_proxy {}` if you actually need per-group DNS customization via the bridge network."],"exampleFix":"// before\nnetwork {\n  dns { servers = [\"10.0.0.10\"] }\n}\nservice {\n  connect { sidecar_service { proxy { transparent_proxy {} } } }\n}\n// after\nnetwork {\n  dns { servers = [\"10.0.0.10\"] }\n}\nservice {\n  connect { sidecar_service { proxy { transparent_proxy { no_dns = true } } } }\n}","handlingStrategy":"validation","validationCode":"// Reject transparent proxy + network.dns without no_dns before submission.\nfunction validateTproxyDns(groups) {\n  for (const g of groups) {\n    const hasDns = (g.networks ?? []).some(n => n.dns && (n.dns.servers?.length || n.dns.options?.length));\n    for (const s of g.services ?? []) {\n      const tp = s.connect?.sidecar_service?.proxy?.transparent_proxy;\n      if (tp && hasDns && tp.no_dns !== true) {\n        throw new Error(`group ${g.name}: transparent_proxy needs no_dns=true or no network.dns`);\n      }\n    }\n  }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["When adding transparent_proxy to an existing group, audit the network stanza for a dns block first.","Prefer removing group-level dns and relying on Consul/DNS at the host or cluster level when using transparent proxy.","Run `nomad job validate` in CI to catch the conflict before scheduling."],"tags":["consul-connect","transparent-proxy","dns","nomad-job-spec","validation"],"backgroundTag":"incompatible-proxy-dns-config","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}