ginuerzh/gost · error

%s: %v

Error message

%s: %v

What it means

On Windows, createTun assigns the TUN interface address via `netsh interface ip set address ... source=static addr=<ip> mask=<mask> gateway=none`; a non-zero exit is wrapped with the command. netsh failures usually mean the interface name is wrong, privileges are missing, or the IP/mask is invalid.

Source

Thrown at tuntap_windows.go:37

	ifce, err := water.New(water.Config{
		DeviceType: water.TUN,
		PlatformSpecificParams: water.PlatformSpecificParams{
			ComponentID:   "tap0901",
			InterfaceName: cfg.Name,
			Network:       cfg.Addr,
		},
	})
	if err != nil {
		return
	}

	cmd := fmt.Sprintf("netsh interface ip set address name=\"%s\" "+
		"source=static addr=%s mask=%s gateway=none",
		ifce.Name(), ip.String(), ipMask(ipNet.Mask))
	log.Log("[tun]", cmd)
	args := strings.Split(cmd, " ")
	if er := exec.Command(args[0], args[1:]...).Run(); er != nil {
		err = fmt.Errorf("%s: %v", cmd, er)
		return
	}

	if err = addTunRoutes(ifce.Name(), cfg.Gateway, cfg.Routes...); err != nil {
		return
	}

	itf, err = net.InterfaceByName(ifce.Name())
	if err != nil {
		return
	}

	conn = &tunTapConn{
		ifce: ifce,
		addr: &net.IPAddr{IP: ip},
	}
	return
}

View on GitHub (pinned to a33fdbf4c9)

Solutions

1. Run the program as Administrator (elevated terminal or manifest requiring admin)
2. Verify the interface name in the wrapped command still exists (`netsh interface show interface`)
3. Check addr/mask values: ensure cfg.Addr parses to a valid IPv4 and the mask is a dotted-decimal netmask
4. Retry after confirming no other software (VPN client, device manager) removed the adapter

Example fix

// before
c:\> app.exe // non-elevated -> netsh fails: The requested operation requires elevation
// after
c:\> run as Administrator: elevated prompt -> app.exe

func checkWindowsTunPreconditions(cfg tun.Config) error {
    ip := net.ParseIP(strings.SplitN(cfg.Addr, "/", 2)[0])
    if ip == nil || ip.To4() == nil {
        return fmt.Errorf("invalid IPv4 addr %q", cfg.Addr)
    }
    if !isAdmin() {
        return errors.New("must run elevated as Administrator")
    }
    return nil
}

func isAdmin() bool {
    _, err := exec.LookPath("netsh")
    return err == nil && isElevated() // isElevated: check via windows token APIs or `net session` exit code
}

func netshAvailable() bool { _, err := exec.LookPath("netsh"); return err == nil }

ifce, err := tun.CreateTun(cfg)
if err != nil && strings.Contains(err.Error(), "netsh") {
    if strings.Contains(err.Error(), "elevation") || strings.Contains(err.Error(), "denied") {
        return fmt.Errorf("restart process as Administrator: %w", err)
    }
    return fmt.Errorf("netsh failed — check adapter exists: %w", err)
}

When it happens

Trigger: createTun on Windows when the Wintun/TAP interface name changed or was removed before netsh ran, the process is not elevated, or ip.String()/ipMask produced an invalid pair.

Common situations: Running in a non-admin shell (netsh needs elevation); antivirus or the VPN driver renaming/removing the interface concurrently; malformed subnet mask from ipMask.

Related errors

• %s: %v
• %s: %v
• UDP redirect is not available on the Windows platform
• deadline not supported
• tap is not supported on darwin

AI-assisted analysis of ginuerzh/gost@a33fdbf4c9 (2026-09-02). Data as JSON: /api/errors/f8c36caee13a62a7. Report an issue: GitHub.