{"record":{"id":"8d8a2a731c90f6e7","repo":"slackhq/nebula","slug":"failed-to-set-tun-mtu-w","errorCode":null,"errorMessage":"failed to set tun mtu: %w","messagePattern":"failed to set tun mtu: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"overlay/tun_netbsd.go","lineNumber":318,"sourceCode":"\treturn fmt.Errorf(\"unknown address type %v\", cidr)\n}\n\nfunc (t *tun) Activate() error {\n\tmode := int32(unix.IFF_BROADCAST)\n\terr := ioctl(uintptr(t.fd), TUNSIFMODE, uintptr(unsafe.Pointer(&mode)))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to set tun device mode: %w\", err)\n\t}\n\n\tv := 1\n\terr = ioctl(uintptr(t.fd), TUNSIFHEAD, uintptr(unsafe.Pointer(&v)))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to set tun device head: %w\", err)\n\t}\n\n\terr = t.doIoctlByName(unix.SIOCSIFMTU, uint32(t.MTU))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to set tun mtu: %w\", err)\n\t}\n\n\tfor i := range t.vpnNetworks {\n\t\terr = t.addIp(t.vpnNetworks[i])\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\n\treturn t.addRoutes(false)\n}\n\nfunc (t *tun) doIoctlByName(ctl uintptr, value uint32) error {\n\ts, err := unix.Socket(unix.AF_INET, unix.SOCK_DGRAM, unix.IPPROTO_IP)\n\tif err != nil {\n\t\treturn err\n\t}\n\tdefer syscall.Close(s)","sourceCodeStart":300,"sourceCodeEnd":336,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/overlay/tun_netbsd.go#L300-L336","documentation":"This error is returned by the NetBSD tun Activate method when the SIOCSIFMTU ioctl fails, i.e. the interface MTU could not be set to the configured value. Without setting the MTU, the tunnel may fragment or drop packets, so activation aborts. The error wraps the underlying errno for diagnosis.","triggerScenarios":"Calling Activate() where doIoctlByName(unix.SIOCSIFMTU, mtu) fails — typically an invalid MTU value (0, negative, or below the interface minimum), or the fd is not associated with a live interface.","commonSituations":"A config file with tun.mtu set to an out-of-range value; running without root; the tun interface being destroyed before activation completes.","solutions":["Check the tun.mtu config value is a sane positive number (typically 1300–1500) and remove/fix extreme values.","Ensure the process runs as root so SIOCSIFMTU is permitted.","Inspect the wrapped errno via errors.Is/As to distinguish EPERM from EINVAL.","Confirm the tun device was successfully opened and configured before Activate is called."],"exampleFix":"// before\n tun:\n   mtu: 0\n// after\n tun:\n   mtu: 1300","handlingStrategy":"validation","validationCode":"mtu := c.GetInt(\"tun.mtu\", 1300)\nif mtu <= 0 || mtu > 9000 {\n    return fmt.Errorf(\"invalid tun.mtu %d; use a value between 1 and 9000 (typical: 1300-1500)\", mtu)\n}\nif os.Geteuid() != 0 {\n    return fmt.Errorf(\"setting interface MTU requires root privileges\")\n}","typeGuard":null,"tryCatchPattern":"if err := t.Activate(); err != nil {\n    var syscallErr syscall.Errno\n    if errors.As(err, &syscallErr) && syscallErr == unix.EINVAL {\n        // MTU value rejected — fall back to a sane default\n    }\n    return err\n}","preventionTips":["Keep tun.mtu within the interface-supported range (typically 1300–1500 for VPNs).","Run as root so SIOCSIFMTU is permitted.","Do not remove or destroy the tun interface between newTun and Activate.","Use the default MTU unless you have a specific reason to override it."],"tags":["netbsd","tun","mtu","ioctl"],"backgroundTag":"tun-ioctl-failed","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}