cloudflare/cloudflared · error

Invalid CIDR supplied for %s

Error message

Invalid CIDR supplied for %s

What it means

cidrFromFlag builds an IpRouteFilter from a CLI flag value by parsing it with net.ParseCIDR. When the parsed subset is nil (or parsing fails earlier), it reports that the CIDR supplied for the given flag name is invalid. This guards route filtering so only well-formed networks are used to query the API.

Source

Thrown at cfapi/ip_route_filter.go:119

	if maxFetch := c.Int("max-fetch-size"); maxFetch > 0 {
		f.MaxFetchSize(uint(maxFetch))
	}

	return f, nil
}

// Parses a CIDR from the flag. If the flag was unset, returns (nil, nil).
func cidrFromFlag(c *cli.Context, flag cli.StringFlag) (*net.IPNet, error) {
	if !c.IsSet(flag.Name) {
		return nil, nil
	}

	_, subset, err := net.ParseCIDR(c.String(flag.Name))
	if err != nil {
		return nil, err
	} else if subset == nil {
		return nil, fmt.Errorf("Invalid CIDR supplied for %s", flag.Name)
	}

	return subset, nil
}

func NewIPRouteFilter() *IpRouteFilter {
	values := &IpRouteFilter{queryParams: url.Values{}}

	// always list cfd_tunnel routes only
	values.queryParams.Set("tun_types", "cfd_tunnel")

	return values
}

func (f *IpRouteFilter) CommentIs(comment string) {
	f.queryParams.Set("comment", comment)
}

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Supply a valid CIDR with an explicit prefix, e.g. 10.0.0.0/24 or 2001:db8::/32; for a single IP use x.x.x.x/32.
2. Check the flag's expected name/value via the command's --help output.
3. Use a calculator or `ipcalc`/`cidrify` to convert IP ranges into CIDR notation before passing them.
4. If passing via script, quote the value so shells do not split on '/': --ip "10.0.0.0/24".

Example fix

// before
$ cloudflared tunnel route ip filter --ip 10.0.0.1
// after
$ cloudflared tunnel route ip filter --ip 10.0.0.1/32

_, _, err := net.ParseCIDR(flagValue)
if err != nil || flagValue == "" {
	return fmt.Errorf("flag %s requires a valid CIDR like 10.0.0.0/24", flagName)
}

When it happens

Trigger: Running cloudflared tunnel ip filter (route filter) commands with a flag value that is not a valid CIDR, e.g. `--ip 10.0.0.1` (missing prefix), `10.0.0.0/33`, or a hostname.

Common situations: Typing an IP without a prefix length; confusing IPv4/IPv6 notation; copy-pasting ranges like `10.0.0.0-10.0.0.255` (dash ranges are not CIDR); shell mangling of slashes.

Understand the failure class

Background: "unknown output mode", "invalid value for flag", "expects true/false": fixing invalid flag value errors in CLI tools — this error's family across 24 libraries.

Related errors

• errAddRoute
• Invalid network CIDR
• invalid connection override: %s
• Couldn't decode tunnel secret from base64
• not a valid host

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/8f5cd703a0d42db0. Report an issue: GitHub.