{"record":{"id":"8fad608f9da57fdc","repo":"slackhq/nebula","slug":"no-firewall-rules","errorCode":null,"errorMessage":"no firewall rules","messagePattern":"no firewall rules","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"interface.go","lineNumber":195,"sourceCode":"\tcase recvErrorPrivate:\n\t\treturn \"private\"\n\tdefault:\n\t\treturn fmt.Sprintf(\"invalid(%d)\", s)\n\t}\n}\n\nfunc NewInterface(ctx context.Context, c *InterfaceConfig) (*Interface, error) {\n\tif c.Outside == nil {\n\t\treturn nil, errors.New(\"no outside connection\")\n\t}\n\tif c.Inside == nil {\n\t\treturn nil, errors.New(\"no inside interface (tun)\")\n\t}\n\tif c.pki == nil {\n\t\treturn nil, errors.New(\"no certificate state\")\n\t}\n\tif c.Firewall == nil {\n\t\treturn nil, errors.New(\"no firewall rules\")\n\t}\n\tif c.connectionManager == nil {\n\t\treturn nil, errors.New(\"no connection manager\")\n\t}\n\n\tif c.routines <= 1 {\n\t\tc.PinThreads = false //pinning is not useful unless there's more than one tun reader\n\t}\n\n\tcs := c.pki.getCertState()\n\tifce := &Interface{\n\t\tctx:                   ctx,\n\t\tpki:                   c.pki,\n\t\thostMap:               c.HostMap,\n\t\toutside:               c.Outside,\n\t\tinside:                c.Inside,\n\t\tfirewall:              c.Firewall,\n\t\tdnsServer:             c.DnsServer,","sourceCodeStart":177,"sourceCodeEnd":213,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/interface.go#L177-L213","documentation":"Configuration guard in NewInterface: InterfaceConfig.Firewall is nil — no firewall instance was supplied. Nebula refuses to start without a firewall because the default-deny security model requires one.","triggerScenarios":"InterfaceConfig.Firewall is nil because firewall rules compilation failed or was omitted when building the config in Main.","commonSituations":"Invalid firewall rules in config causing NewFirewall to fail upstream; firewall section missing entirely; custom embedding not populating the field.","solutions":["Check earlier logs for firewall rule compilation errors and fix the offending rule","Ensure the firewall section exists in config with at least an outbound/default rule set","Verify config schema (groups, cidr, port fields) matches nebula's expected format"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if cfg.InterfaceConfig.Firewall == nil {\n    return errors.New(\"firewall rules not compiled; check firewall config section\")\n}","typeGuard":null,"tryCatchPattern":"i, err := NewInterface(ctx, c)\nif err != nil {\n    if err.Error() == \"no firewall rules\" { /* fix firewall config errors reported earlier in logs */ }\n    return err\n}","preventionTips":["Compile firewall rules early and surface rule errors before interface creation","Always include a firewall section (even a minimal outbound allow)","Lint firewall rule fields (groups, cidr, port ranges) against nebula's schema"],"tags":["config","firewall","nebula","startup"],"backgroundTag":"missing-required-config","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}