{"record":{"id":"da373f39304aff9f","repo":"slackhq/nebula","slug":"failed-to-set-default-route-mtu-w","errorCode":null,"errorMessage":"failed to set default route MTU: %w","messagePattern":"failed to set default route MTU: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"overlay/tun_linux.go","lineNumber":496,"sourceCode":"\tconst modeNone = 1\n\tif err = netlink.LinkSetIP6AddrGenMode(link, modeNone); err != nil {\n\t\tt.l.Warn(\"Failed to disable link local address generation\", \"error\", err)\n\t}\n\n\tif err = t.addIPs(link); err != nil {\n\t\treturn err\n\t}\n\n\t// Bring up the interface\n\tifrf.Flags = ifrf.Flags | unix.IFF_UP\n\tif err = ioctl(t.ioctlFd, unix.SIOCSIFFLAGS, uintptr(unsafe.Pointer(&ifrf))); err != nil {\n\t\treturn fmt.Errorf(\"failed to bring the tun device up: %s\", err)\n\t}\n\n\t//set route MTU\n\tfor i := range t.vpnNetworks {\n\t\tif err = t.setDefaultRoute(t.vpnNetworks[i]); err != nil {\n\t\t\treturn fmt.Errorf(\"failed to set default route MTU: %w\", err)\n\t\t}\n\t}\n\n\t// Set the routes\n\tif err = t.addRoutes(false); err != nil {\n\t\treturn err\n\t}\n\n\t// Run the interface\n\tifrf.Flags = ifrf.Flags | unix.IFF_UP | unix.IFF_RUNNING\n\tif err = ioctl(t.ioctlFd, unix.SIOCSIFFLAGS, uintptr(unsafe.Pointer(&ifrf))); err != nil {\n\t\treturn fmt.Errorf(\"failed to run tun device: %s\", err)\n\t}\n\n\treturn nil\n}\n\nfunc (t *tun) setMTU() {","sourceCodeStart":478,"sourceCodeEnd":514,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/overlay/tun_linux.go#L478-L514","documentation":"Raised in tun.Activate when setDefaultRoute fails for one of the configured vpnNetworks. setDefaultRoute applies the route MTU for the default route covering the VPN CIDR; the wrapped error (%w) carries the underlying netlink/route failure.","triggerScenarios":"Activate() with vpnNetworks configured and t.setDefaultRoute(cidr) returning an error — no matching default route exists in the route table, or the route modification is rejected (permissions, missing route).","commonSituations":"Host has no IPv4 (or no IPv6) default route while vpnNetworks includes that family; DefaultMTU misconfigured; lack of CAP_NET_ADMIN preventing route MTU changes.","solutions":["Check the wrapped error: 'no such route' means the host lacks a default route for that address family — add one or remove that family from vpnNetworks.","Verify a default route exists: ip route show default / ip -6 route show default.","Run with CAP_NET_ADMIN so route metrics/MTU can be modified.","Check tun.DefaultMTU is a sane value in config.","Unwrap with errors.Unwrap to see the netlink errno and target the specific fix."],"exampleFix":"// before: vpnNetworks contains 0.0.0.0/0 but host has no IPv4 default route\n// after — restrict to available family or add a default route\n# ip route add default via 192.168.1.1\n// or in config\ntun: { routes: [] }","handlingStrategy":"validation","validationCode":"// require a default route for each vpnNetwork family before Activate\nfor _, p := range vpnNetworks {\n    fam := netlink.FAMILY_V4\n    if p.Addr().Is6() { fam = netlink.FAMILY_V6 }\n    routes, err := netlink.RouteList(nil, fam)\n    if err != nil || !hasDefault(routes) {\n        return fmt.Errorf(\"no default route for %s; setDefaultRoute MTU will fail\", p)\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := t.Activate(netstack); err != nil {\n    if strings.Contains(err.Error(), \"failed to set default route MTU\") {\n        log.Error(\"default route missing or unmodifiable\", \"cause\", errors.Unwrap(err))\n    }\n}","preventionTips":["Ensure the host has a default route for every family in vpnNetworks","Verify tun.default_mtu is set to a plausible value (1300-1400)","Run with CAP_NET_ADMIN for route metric changes","Retry after DHCP/network stabilization if the default route flaps"],"tags":["network","routing","tun","mtu"],"backgroundTag":"route-configuration-failed","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}