cloudflare/cloudflared · error

Invalid network CIDR

Error message

Invalid network CIDR

What it means

addRouteCommand parses the first positional argument with net.ParseCIDR. If parsing fails (or the parsed network is nil), it wraps the underlying parse error or returns this message, meaning the first argument is not a valid CIDR like 1.2.3.4/32.

Source

Thrown at cmd/cloudflared/tunnel/teamnet_subcommands.go:147

}

func addRouteCommand(c *cli.Context) error {
	sc, err := newSubcommandContext(c)
	if err != nil {
		return err
	}
	if c.NArg() < 2 {
		return errors.New("You must supply at least 2 arguments, first the network you wish to route (in CIDR form e.g. 1.2.3.4/32) and then the tunnel ID to proxy with")
	}

	args := c.Args()

	_, network, err := net.ParseCIDR(args.Get(0))
	if err != nil {
		return errors.Wrap(err, "Invalid network CIDR")
	}
	if network == nil {
		return errors.New("Invalid network CIDR")
	}

	tunnelRef := args.Get(1)
	tunnelID, err := sc.findID(tunnelRef)
	if err != nil {
		return errors.Wrap(err, "Invalid tunnel")
	}

	comment := ""
	if c.NArg() >= 3 {
		comment = args.Get(2)
	}

	var vnetId *uuid.UUID
	if c.IsSet(vnetFlag.Name) {
		id, err := getVnetId(sc, c.String(vnetFlag.Name))
		if err != nil {
			return err

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Append a prefix length: use `1.2.3.4/32` for a single IPv4 or `2001:db8::/64` style for IPv6
2. Validate the CIDR before running, e.g. `python3 -c "import ipaddress; ipaddress.ip_network('10.0.0.0/8')"`
3. Read the wrapped ParseCIDR error above this message in the output to see the exact parse problem

Example fix

// before
$ cloudflared tunnel route ip add 1.2.3.4 my-tunnel
// error: Invalid network CIDR
// after
$ cloudflared tunnel route ip add 1.2.3.4/32 my-tunnel

# validate CIDR before calling the CLI
python3 -c "import ipaddress,sys; ipaddress.ip_network(sys.argv[1], strict=False)" "$CIDR" || { echo "invalid CIDR: $CIDR"; exit 1; }

When it happens

Trigger: Running `cloudflared tunnel route ip add` with a first argument that is a bare IP (e.g. 1.2.3.4 without /32), a hostname, a malformed CIDR (e.g. 10.0.0.0/33), or an empty string.

Common situations: Passing a plain IP instead of CIDR notation; typos like /128 on IPv4; Windows shells mangling the slash; copying an IP from output without the prefix length.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• errAddRoute
• Invalid CIDR supplied for %s
• not a valid host
• no input provided
• failed to parse Host

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/08d849f072994a17. Report an issue: GitHub.