cloudflare/cloudflared · error

unable to create ip access policy for %s: %s

Error message

unable to create ip access policy for %s: %s

What it means

After building individual ipaccess.Rules for a socks-proxy ingress service, validateIngress assembles them into an ipaccess.Policy with NewPolicy(false, rules). If policy construction fails (e.g. no rules provided), this wrapped error is returned and the ingress rule is rejected.

Source

Thrown at ingress/ingress.go:283

			}
			srv := newStatusCode(statusCode)
			service = &srv
		} else if r.Service == HelloWorldFlag || r.Service == HelloWorldService {
			service = new(helloWorld)
		} else if r.Service == ServiceSocksProxy {
			rules := make([]ipaccess.Rule, len(r.OriginRequest.IPRules))

			for i, ipRule := range r.OriginRequest.IPRules {
				rule, err := ipaccess.NewRuleByCIDR(ipRule.Prefix, ipRule.Ports, ipRule.Allow)
				if err != nil {
					return Ingress{}, fmt.Errorf("unable to create ip rule for %s: %s", r.Service, err)
				}
				rules[i] = rule
			}

			accessPolicy, err := ipaccess.NewPolicy(false, rules)
			if err != nil {
				return Ingress{}, fmt.Errorf("unable to create ip access policy for %s: %s", r.Service, err)
			}

			service = newSocksProxyOverWSService(accessPolicy)
		} else if r.Service == ServiceBastion || cfg.BastionMode {
			// Bastion mode will always start a Websocket proxy server, which will
			// overwrite the localService.URL field when `start` is called. So,
			// leave the URL field empty for now.
			cfg.BastionMode = true
			service = newBastionService()
		} else {
			// Validate URL services
			u, err := url.Parse(r.Service)
			if err != nil {
				return Ingress{}, err
			}

			if u.Scheme == "" || u.Hostname() == "" {
				return Ingress{}, fmt.Errorf("%s is an invalid address, please make sure it has a scheme and a hostname", r.Service)

View on GitHub (pinned to 2253eeeb25)

Solutions

  1. Provide at least one valid ipRules entry under originRequest for the socks-proxy service
  2. Check the underlying NewPolicy error message (embedded after the service name) for the exact cause
  3. Verify the config file section parses as a list, not a scalar

Example fix

// before
service: socks-proxy
// (no originRequest.ipRules)
// after
service: socks-proxy
originRequest:
  ipRules:
    - prefix: 0.0.0.0/0
      allow: true
Defensive patterns

Strategy: validation

Validate before calling

if svc == "socks-proxy" && len(ipRules) == 0 {
	return errors.New("socks-proxy requires at least one ipRule")
}

Try / catch

if err := ingress.ParseIngress(cfg); err != nil {
	if strings.Contains(err.Error(), "unable to create ip access policy") {
		// inspect embedded cause and fix ipRules/policy inputs
	}
	return err
}

Prevention

When it happens

Trigger: UnmarshalJSON/ParseIngress with `service: socks-proxy` where ipaccess.NewPolicy returns an error — typically when the ipRules list is empty or internally inconsistent after per-rule validation passed.

Common situations: A socks-proxy rule with no ipRules defined at all, or config where rules were filtered out leaving an empty set the policy rejects.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/4a7de536313806e8. Report an issue: GitHub.