cloudflare/cloudflared · error

invalid port %d, needs to be between 1 and 65535

Error message

invalid port %d, needs to be between 1 and 65535

What it means

Range validation in ipaccess Rule.Validate: a rule was constructed (via NewRule) with a port number outside the valid TCP/UDP range 1-65535. The rule set is rejected at construction time so an unusable access policy never reaches enforcement.

Source

Thrown at ipaccess/access.go:66

func NewRule(ipnet *net.IPNet, ports []int, allow bool) (Rule, error) {
	rule := Rule{
		ipNet: ipnet,
		ports: ports,
		allow: allow,
	}
	return rule, rule.Validate()
}

func (r *Rule) Validate() error {
	if r.ipNet == nil {
		return fmt.Errorf("no ipnet set on the rule")
	}

	if len(r.ports) > 0 {
		sort.Ints(r.ports)
		for _, port := range r.ports {
			if port < 1 || port > 65535 {
				return fmt.Errorf("invalid port %d, needs to be between 1 and 65535", port)
			}
		}
	}

	return nil
}

func (h *Policy) Allowed(ip net.IP, port int) (bool, *Rule) {
	if len(h.rules) == 0 {
		return h.defaultAllow, nil
	}

	for _, rule := range h.rules {
		if rule.ipNet.Contains(ip) {
			if len(rule.ports) == 0 {
				return rule.allow, &rule
			} else if pos := sort.SearchInts(rule.ports, port); pos < len(rule.ports) && rule.ports[pos] == port {
				return rule.allow, &rule

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Check the ports list passed to NewRule; every entry must be an integer between 1 and 65535.
2. Remove 0 or negative placeholders and out-of-range values; ports are sorted and validated one by one.
3. If ports are user-supplied, validate them before calling NewRule.

When it happens

Trigger: Thrown at ipaccess/access.go:66 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/c8dcb4c1fb8ac887. Report an issue: GitHub.