{"record":{"id":"c795827ead5d7c8e","repo":"slackhq/nebula","slug":"unable-to-create-af-route-socket-v","errorCode":null,"errorMessage":"unable to create AF_ROUTE socket: %v","messagePattern":"unable to create AF_ROUTE socket: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"overlay/tun_darwin.go","lineNumber":425,"sourceCode":"\tfor _, r := range routes {\n\t\tif !r.Install {\n\t\t\tcontinue\n\t\t}\n\n\t\terr := delRoute(r.Cidr, t.linkAddr)\n\t\tif err != nil {\n\t\t\tt.l.Error(\"Failed to remove route\", \"error\", err, \"route\", r)\n\t\t} else {\n\t\t\tt.l.Info(\"Removed route\", \"route\", r)\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc addRoute(prefix netip.Prefix, gateway netroute.Addr) error {\n\tsock, err := unix.Socket(unix.AF_ROUTE, unix.SOCK_RAW, unix.AF_UNSPEC)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"unable to create AF_ROUTE socket: %v\", err)\n\t}\n\tdefer unix.Close(sock)\n\n\troute := &netroute.RouteMessage{\n\t\tVersion: unix.RTM_VERSION,\n\t\tType:    unix.RTM_ADD,\n\t\tFlags:   unix.RTF_UP,\n\t\tSeq:     1,\n\t}\n\n\tif prefix.Addr().Is4() {\n\t\troute.Addrs = []netroute.Addr{\n\t\t\tunix.RTAX_DST:     &netroute.Inet4Addr{IP: prefix.Masked().Addr().As4()},\n\t\t\tunix.RTAX_NETMASK: &netroute.Inet4Addr{IP: prefixToMask(prefix).As4()},\n\t\t\tunix.RTAX_GATEWAY: gateway,\n\t\t}\n\t} else {\n\t\troute.Addrs = []netroute.Addr{","sourceCodeStart":407,"sourceCodeEnd":443,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/overlay/tun_darwin.go#L407-L443","documentation":"addRoute() programs a kernel route by opening a raw AF_ROUTE routing socket and sending an RTM_ADD message. This error is returned when unix.Socket(AF_ROUTE, SOCK_RAW, AF_UNSPEC) fails, i.e. a routing socket could not be created at all, before any route message is built or sent.","triggerScenarios":"Called from activate4() or addRoutes(); unix.Socket returns an error, typically EPERM because the process lacks privileges to open a raw route socket, or resource limits (EMFILE/ENFILE) are hit.","commonSituations":"Nebula started without root/admin privileges on macOS; hard process file-descriptor limits exhausted in environments running many sockets; restricted macOS sandbox blocking AF_ROUTE sockets.","solutions":["Run nebula as root (or with the privileges required to open routing sockets on macOS).","Check the wrapped errno: EPERM => insufficient privileges; EMFILE/ENFILE => raise `ulimit -n` / system file limit.","Verify the sandbox/container policy permits AF_ROUTE sockets; move nebula to the host if it does not.","Restart the host if the routing socket table is exhausted (kernel-level ENOBUFS)."],"exampleFix":"// before\n$ ./nebula -config config.yaml\n// after\n$ sudo ./nebula -config config.yaml","handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"var rerr error\nfor i := 0; i < 3; i++ {\n    rerr = iface.Activate()\n    if rerr == nil || !strings.Contains(rerr.Error(), \"unable to create AF_ROUTE socket\") {\n        break\n    }\n    time.Sleep(200 * time.Millisecond) // transient EMFILE/ENOBUFS\n}\nreturn rerr","preventionTips":["Run nebula as root/admin","Raise fd limits (`ulimit -n`) in high-socket-count environments","Ensure sandbox policies allow AF_ROUTE sockets","Monitor fd usage if nebula runs alongside many other network daemons"],"tags":["network","darwin","routing","socket","permissions"],"backgroundTag":"route-socket-creation-failed","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}