cloudflare/cloudflared · error

no prefix provided

Error message

no prefix provided

What it means

ipaccess.NewRuleByCIDR requires a non-nil, non-empty CIDR prefix string. If the prefix pointer is nil or the string is empty, no rule can be built and this error is returned immediately, before CIDR parsing.

Solutions

1. Provide a valid prefix (CIDR string) for every ipRules entry, e.g. `prefix: 10.0.0.0/8`
2. Check YAML indentation so each entry's prefix key is actually populated
3. Validate prefix presence programmatically before calling NewRuleByCIDR

Example fix

// before
ipRules:
  - ports: [80]
    allow: true
// after
ipRules:
  - prefix: 10.0.0.0/8
    ports: [80]
    allow: true

func validPrefix(p *string) bool {
	return p != nil && len(*p) > 0 && func() bool { _, _, err := net.ParseCIDR(*p); return err == nil }()
}

When it happens

Trigger: Calling NewRuleByCIDR(nil, ports, allow) or NewRuleByCIDR(&empty, ...), or indirectly through validateIngress / setIPRules / originRequestFromConfig when an ipRules entry lacks a prefix field.

Common situations: YAML ipRules entries with the `prefix` key omitted or mis-indented so it deserializes to nil, or programmatic construction of rules with an unset prefix.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• unable to parse cidr
• errAddRoute
• Invalid CIDR supplied for
• Invalid network CIDR
• unable to create ip rule for

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/5a52ba53e200ed71. Report an issue: GitHub.

Appendix: source

Thrown at ipaccess/access.go:37

func NewPolicy(defaultAllow bool, rules []Rule) (*Policy, error) {
	for _, rule := range rules {
		if err := rule.Validate(); err != nil {
			return nil, err
		}
	}

	policy := Policy{
		defaultAllow: defaultAllow,
		rules:        rules,
	}

	return &policy, nil
}

func NewRuleByCIDR(prefix *string, ports []int, allow bool) (Rule, error) {
	if prefix == nil || len(*prefix) == 0 {
		return Rule{}, fmt.Errorf("no prefix provided")
	}

	_, ipnet, err := net.ParseCIDR(*prefix)
	if err != nil {
		return Rule{}, fmt.Errorf("unable to parse cidr: %s", *prefix)
	}

	return NewRule(ipnet, ports, allow)
}

func NewRule(ipnet *net.IPNet, ports []int, allow bool) (Rule, error) {
	rule := Rule{
		ipNet: ipnet,
		ports: ports,
		allow: allow,
	}
	return rule, rule.Validate()
}

View on GitHub (pinned to 2253eeeb25)