could not parse transparent proxy excluded outbound CIDR as

Error message

could not parse transparent proxy excluded outbound CIDR as network prefix: %w

What it means

During ConnectTransparentProxy validation, each ExcludeOutboundCIDRs entry is parsed with netip.ParsePrefix. Any string that is not a valid CIDR prefix is appended as this error to a multi-error. The message intentionally includes the parse error, which always embeds the offending string.

Source

Thrown at nomad/structs/connect.go:125

	*ntp = *tp

	ntp.ExcludeInboundPorts = slices.Clone(tp.ExcludeInboundPorts)
	ntp.ExcludeOutboundPorts = slices.Clone(tp.ExcludeOutboundPorts)
	ntp.ExcludeOutboundCIDRs = slices.Clone(tp.ExcludeOutboundCIDRs)
	ntp.ExcludeUIDs = slices.Clone(tp.ExcludeUIDs)

	return ntp
}

func (tp *ConsulTransparentProxy) Validate() error {
	var mErr multierror.Error

	for _, rawCidr := range tp.ExcludeOutboundCIDRs {
		_, err := netip.ParsePrefix(rawCidr)
		if err != nil {
			// note: error returned always include parsed string
			mErr.Errors = append(mErr.Errors,
				fmt.Errorf("could not parse transparent proxy excluded outbound CIDR as network prefix: %w", err))
		}
	}

	requireUIDisUint := func(uidRaw string) error {
		_, err := strconv.ParseUint(uidRaw, 10, 16)
		if err != nil {
			e, ok := err.(*strconv.NumError)
			if !ok {
				return fmt.Errorf("invalid user ID %q: %w", uidRaw, err)
			}
			return fmt.Errorf("invalid user ID %q: %w", uidRaw, e.Err)
		}
		return nil
	}

	if tp.UID != "" {
		if err := requireUIDisUint(tp.UID); err != nil {
			mErr.Errors = append(mErr.Errors,

View on GitHub (pinned to 482b49bf1a)

Solutions

Rewrite the entry as a valid CIDR, e.g. 10.0.0.1/32 for a single host
Check the prefix length is valid for the address family (0-32 IPv4, 0-128 IPv6)
Remove entries that aren't needed from exclude_outbound_cidrs

Example fix

// before
transparent_proxy {
  exclude_outbound_cidrs = ["10.0.0.1"]
}
// after
transparent_proxy {
  exclude_outbound_cidrs = ["10.0.0.1/32"]
}

Defensive patterns

Strategy: validation

Validate before calling

for _, cidr := range tp.ExcludeOutboundCIDRs {
    if _, err := netip.ParsePrefix(cidr); err != nil {
        return fmt.Errorf("exclude_outbound_cidrs entry %q invalid: %w", cidr, err)
    }
}

Try / catch

if err := tp.Validate(); err != nil {
    var mErr multierror
    if errors.As(err, &mErr) { for _, e := range mErr.Errors { log.Print(e) } }
}

Prevention

Always include a prefix length (/32 for single hosts)
Validate CIDRs with `ipcalc` or netip.ParsePrefix in CI before submitting jobs
Keep IPv4 and IPv6 entries in separate, correctly-formatted lists

When it happens

Trigger: A transparent_proxy block lists an exclude_outbound_cidrs entry like '10.0.0.0/33', '10.0.0.1' (missing prefix), or '::1/300' and Validate() runs.

Common situations: Using bare IPs without /32; typos in prefix length; IPv6/IPv4 confusion; copying iptables-style ranges that netip rejects.

Related errors

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/1dbe50d6099e5fb8. Report an issue: GitHub.