cloudflare/cloudflared · error

unable to parse cidr: %s

Error message

unable to parse cidr: %s

What it means

After confirming the prefix is non-empty, NewRuleByCIDR parses it with net.ParseCIDR. Any string that is not a valid CIDR notation (bad IP, invalid mask, extra characters) produces this error, echoing the unparseable prefix back to the caller.

Source

Thrown at ipaccess/access.go:42

		}
	}

	policy := Policy{
		defaultAllow: defaultAllow,
		rules:        rules,
	}

	return &policy, nil
}

func NewRuleByCIDR(prefix *string, ports []int, allow bool) (Rule, error) {
	if prefix == nil || len(*prefix) == 0 {
		return Rule{}, fmt.Errorf("no prefix provided")
	}

	_, ipnet, err := net.ParseCIDR(*prefix)
	if err != nil {
		return Rule{}, fmt.Errorf("unable to parse cidr: %s", *prefix)
	}

	return NewRule(ipnet, ports, allow)
}

func NewRule(ipnet *net.IPNet, ports []int, allow bool) (Rule, error) {
	rule := Rule{
		ipNet: ipnet,
		ports: ports,
		allow: allow,
	}
	return rule, rule.Validate()
}

func (r *Rule) Validate() error {
	if r.ipNet == nil {
		return fmt.Errorf("no ipnet set on the rule")
	}

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Correct the CIDR string to valid notation, e.g. `192.168.0.0/16`
2. Validate with net.ParseCIDR (or an online tool) before writing it to config
3. Ensure host addresses include a mask (use /32 or /128 for a single host)
4. Trim whitespace from the prefix value

Example fix

// before
- prefix: 10.0.0.0/33
// after
- prefix: 10.0.0.0/8

func validCIDR(s string) bool {
	_, _, err := net.ParseCIDR(strings.TrimSpace(s))
	return err == nil
}

rule, err := ipaccess.NewRuleByCIDR(&prefix, ports, allow)
if err != nil {
	if strings.Contains(err.Error(), "unable to parse cidr") {
		return fmt.Errorf("fix CIDR notation for %q (expected a.b.c.d/mask)", prefix)
	}
	return err
}

When it happens

Trigger: Calling NewRuleByCIDR with strings like `10.0.0.0/33`, `999.1.1.0/24`, `10.0.0.0` (no mask), or `10.0.0.0/8 extra` — directly or via config-driven paths (originRequestFromConfig, setIPRules, validateIngress).

Common situations: Typos in config.yaml CIDRs, using host addresses without the /mask, IPv6/IPv4 confusion, or trailing whitespace/comments in the prefix value.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• no prefix provided
• errAddRoute
• Invalid network CIDR
• Invalid CIDR supplied for %s
• unable to create ip rule for %s: %s

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/e84ae92e5c12aef0. Report an issue: GitHub.