netbirdio/netbird · error

port %d out of range (1-65535)

Error message

port %d out of range (1-65535)

What it means

Returned by validateDestinationPort when the destination port integer falls outside 1-65535. Because Atoi accepts a sign, a `-1` port reaches this check as negative; anything above 65535 (70000, 808080) is the more typical hit. The check is a plain less/greater comparison after the equality-to-zero case was handled separately.

Source

Thrown at client/cmd/ssh.go:697

		return nil
	}

	_, portStr, err := net.SplitHostPort(addr)
	if err != nil {
		return fmt.Errorf("parse address %s: %w", addr, err)
	}

	port, err := strconv.Atoi(portStr)
	if err != nil {
		return fmt.Errorf("invalid port %s: %w", portStr, err)
	}

	if port == 0 {
		return fmt.Errorf("port 0 is not valid for destination address")
	}

	if port < 0 || port > 65535 {
		return fmt.Errorf("port %d out of range (1-65535)", port)
	}

	return nil
}

// parsePortForwardSpec parses port forward specifications like "8080:localhost:80" or "[::1]:8080:localhost:80".
// Also supports Unix sockets like "8080:/tmp/socket" or "127.0.0.1:8080:/tmp/socket".
func parsePortForwardSpec(spec string) (string, string, error) {
	// Support formats:
	// port:host:hostport  -> localhost:port -> host:hostport
	// host:port:host:hostport  -> host:port -> host:hostport
	// [host]:port:host:hostport -> [host]:port -> host:hostport
	// port:unix_socket_path -> localhost:port -> unix_socket_path
	// host:port:unix_socket_path -> host:port -> unix_socket_path

	if strings.HasPrefix(spec, "[") && strings.Contains(spec, "]:") {
		return parseIPv6ForwardSpec(spec)
	}

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. Correct the port to the 1-65535 range of the actual service (80, 443, 5432, 8080...).
2. Double-check the source of the number — ports over 65535 usually mean a paste error.
3. When generating specs in scripts, clamp/validate the numeric field before composing the string.

Example fix

# before
netbird ssh -L 8080:cache:63800 peer1
# -> invalid remote address: port 63800 out of range (1-65535)

# after
netbird ssh -L 8080:cache:6379 peer1

if port < 1 || port > 65535 {
	return fmt.Errorf("port %d out of range (1-65535)", port)
}
_ = spec // only compose the -L/-R string after the range check passes

func inPortRange(n int) bool { return n >= 1 && n <= 65535 }

if port > 65535 || port < 0 {
	// range violation: values like 65536/70000 are usually typos or pasted
	// non-port numbers; reject rather than truncate
}

When it happens

Trigger: `-L 8080:host:70000`, `-R 9000:localhost:65536`, or `-L 8080:host:-1` — surfaced via `invalid remote address: port 70000 out of range (1-65535)` or `invalid local address: ...` depending on -L/-R.

Common situations: Typos adding a digit; copied ports from another protocol's space (e.g., an IP octet or an ID pasted as a port); hex or octal-looking values like 0x1f90 (Atoi parses 0x1f90 as 0 then fails? — no, it parses to 0/invalid and is caught earlier, but trailing-digit typos dominate).

Related errors

• invalid port %s: %w
• port 0 is not valid for destination address
• start port forwarding: %w
• local port forward %s: %w
• remote port forward %s: %w

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/a0874c2c415fb775. Report an issue: GitHub.