{"record":{"id":"7254c0dccf852861","repo":"slackhq/nebula","slug":"failed-to-set-tun-address-s","errorCode":null,"errorMessage":"failed to set tun address: %s","messagePattern":"failed to set tun address: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"overlay/tun_darwin.go","lineNumber":298,"sourceCode":"\t\t\tLen:    unix.SizeofSockaddrInet6,\n\t\t\tFamily: unix.AF_INET6,\n\t\t\tAddr:   network.Addr().As16(),\n\t\t},\n\t\tPrefixMask: unix.RawSockaddrInet6{\n\t\t\tLen:    unix.SizeofSockaddrInet6,\n\t\t\tFamily: unix.AF_INET6,\n\t\t\tAddr:   prefixToMask(network).As16(),\n\t\t},\n\t\tLifetime: addrLifetime{\n\t\t\t// never expires\n\t\t\tVltime: 0xffffffff,\n\t\t\tPltime: 0xffffffff,\n\t\t},\n\t\tFlags: _IN6_IFF_NODAD,\n\t}\n\n\tif err := ioctl(uintptr(s), _SIOCAIFADDR_IN6, uintptr(unsafe.Pointer(&ifr))); err != nil {\n\t\treturn fmt.Errorf(\"failed to set tun address: %s\", err)\n\t}\n\n\treturn nil\n}\n\nfunc (t *tun) reload(c *config.C, initial bool) error {\n\tchange, routes, err := getAllRoutesFromConfig(c, t.vpnNetworks, initial)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif !initial && !change {\n\t\treturn nil\n\t}\n\n\trouteTree, err := makeRouteTree(t.l, routes, false)\n\tif err != nil {\n\t\treturn err","sourceCodeStart":280,"sourceCodeEnd":316,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/overlay/tun_darwin.go#L280-L316","documentation":"activate6() assigns an IPv6 address to the utun device using the SIOCAIFADDR_IN6 ioctl, with DAD disabled (_IN6_IFF_NODAD). This error wraps the errno when the kernel rejects the IPv6 address assignment for an IPv6 VPN network in the config.","triggerScenarios":"Activate() -> activate6() for each IPv6 vpnNetwork prefix; the SIOCAIFADDR_IN6 ioctl fails, e.g. IPv6 is disabled in the kernel, the address is already in use, or the requested utun device is invalid.","commonSituations":"Hosts with IPv6 disabled at the OS level while the nebula config still lists an IPv6 tun network; address collisions with an existing IPv6 interface; running without sufficient privileges.","solutions":["Confirm IPv6 is enabled on the host (`netstat -rn | head` shows inet6 routes or `sysctl net.inet6`); enable it or remove the IPv6 entry from the config.","Check the wrapped errno (EEXIST => address already assigned) and choose a non-conflicting IPv6 prefix.","Run nebula with sufficient privileges to change interface addresses.","Verify the IPv6 prefix in the config is well-formed (e.g. fd00::/8 ULA style)."],"exampleFix":"// before: IPv6 disabled on host but configured\n cert_name...\ntun:\n  routes:\n    - route: fd00::/8\n// after: remove IPv6 route or enable IPv6 on the host\ntun:\n  routes: []","handlingStrategy":"validation","validationCode":"out, err := exec.Command(\"sysctl\", \"net.inet6.ip6.forwarding\").Output()\n_ = out\nif err != nil {\n    return fmt.Errorf(\"IPv6 appears disabled on this host; remove IPv6 tun routes or enable IPv6\")\n}\nprefix, err := netip.ParsePrefix(cfg.TunRoute6)\nif err != nil || !prefix.Addr().Is6() {\n    return fmt.Errorf(\"tun route must be a valid IPv6 prefix: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"if err := iface.Activate(); err != nil {\n    if strings.Contains(err.Error(), \"failed to set tun address\") {\n        // IPv6 rejected: enable host IPv6 or drop the IPv6 route from config\n    }\n    return err\n}","preventionTips":["Only configure IPv6 tun networks if the host has IPv6 enabled","Use ULA (fd00::/8) ranges unlikely to collide","Run with sufficient privileges for SIOCAIFADDR_IN6","Check for existing assignments with `ifconfig -a | grep inet6`"],"tags":["network","darwin","ipv6","ioctl","address-assignment"],"backgroundTag":"tun-address-assignment-failed","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}