{"record":{"id":"c2a0000b16587a13","repo":"slackhq/nebula","slug":"failed-to-set-tun-mtu-w-c2a000","errorCode":null,"errorMessage":"failed to set tun mtu: %w","messagePattern":"failed to set tun mtu: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"overlay/tun_openbsd.go","lineNumber":297,"sourceCode":"\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tdefer syscall.Close(s)\n\n\t\tif err := ioctl(uintptr(s), SIOCAIFADDR_IN6, uintptr(unsafe.Pointer(&req))); err != nil {\n\t\t\treturn fmt.Errorf(\"failed to set tun address %s: %s\", cidr.Addr().String(), err)\n\t\t}\n\n\t\treturn nil\n\t}\n\n\treturn fmt.Errorf(\"unknown address type %v\", cidr)\n}\n\nfunc (t *tun) Activate() error {\n\terr := t.doIoctlByName(unix.SIOCSIFMTU, uint32(t.MTU))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to set tun mtu: %w\", err)\n\t}\n\n\tfor i := range t.vpnNetworks {\n\t\terr = t.addIp(t.vpnNetworks[i])\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\n\treturn t.addRoutes(false)\n}\n\nfunc (t *tun) doIoctlByName(ctl uintptr, value uint32) error {\n\ts, err := unix.Socket(unix.AF_INET, unix.SOCK_DGRAM, unix.IPPROTO_IP)\n\tif err != nil {\n\t\treturn err\n\t}\n\tdefer syscall.Close(s)","sourceCodeStart":279,"sourceCodeEnd":315,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/overlay/tun_openbsd.go#L279-L315","documentation":"Activate() first sets the interface MTU via the SIOCSIFMTU ioctl (through doIoctlByName). Failure is wrapped with 'failed to set tun mtu'. The MTU value comes from the tun.mtu config, and the ioctl can fail on permissions or if the value is out of the kernel's accepted range.","triggerScenarios":"t.Activate() invoked during interface bring-up with tun.mtu set to a value the kernel rejects, or the process lacking privileges for SIOCSIFMTU.","commonSituations":"Setting an extreme MTU (e.g. 0 or >65535) in config; running unprivileged; interface in an unexpected state.","solutions":["Set tun.mtu to a sane value (e.g. 1300 for typical VPN overlays)","Run with sufficient privileges","Remove the tun.mtu override to use the default","Check the wrapped errno for the exact kernel reason"],"exampleFix":"# before\ntun:\n  mtu: 90000\n# after\ntun:\n  mtu: 1300","handlingStrategy":"validation","validationCode":"mtu := cfg.GetInt(\"tun.mtu\", 1300)\nif mtu < 576 || mtu > 65535 {\n    return fmt.Errorf(\"tun.mtu %d out of range\", mtu)\n}","typeGuard":null,"tryCatchPattern":"if err := t.Activate(); err != nil && strings.Contains(err.Error(), \"failed to set tun mtu\") {\n    log.Error(\"MTU rejected by kernel; check tun.mtu and privileges\", \"err\", err)\n    return err\n}","preventionTips":["Use a realistic MTU (1200–1500) for VPN overlays","Run privileged or grant interface-management rights","Omit tun.mtu to accept defaults when unsure"],"tags":["openbsd","tun","mtu","ioctl","activate"],"backgroundTag":"ioctl-interface-config-failed","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}