%s is not a valid input for %s. it should be formatted as "I

Error message

%s is not a valid input for %s. it should be formatted as "IP" or "IP/IP", or "IP/Interface Name"

What it means

When a --external-ip-map element contains no '/', it is unambiguously an IP (an interface-only single value makes no sense for NAT mapping), so validateNATExternalIPs requires subElements[0] to parse via net.ParseIP. A single value that is not a valid IP hits this branch.

Source

Thrown at client/cmd/up.go:749

		loginRequest.DisableIpv6 = &disableIPv6
	}

	return &loginRequest, nil
}

func validateNATExternalIPs(list []string) error {
	for _, element := range list {
		if element == "" {
			return fmt.Errorf("empty string is not a valid input for %s", externalIPMapFlag)
		}

		subElements := strings.Split(element, "/")
		if len(subElements) > 2 {
			return fmt.Errorf("%s is not a valid input for %s. it should be formatted as \"String\" or \"String/String\"", element, externalIPMapFlag)
		}

		if len(subElements) == 1 && !isValidIP(subElements[0]) {
			return fmt.Errorf("%s is not a valid input for %s. it should be formatted as \"IP\" or \"IP/IP\", or \"IP/Interface Name\"", element, externalIPMapFlag)
		}

		last := 0
		for _, singleElement := range subElements {
			inputType, err := validateElement(singleElement)
			if err != nil {
				return fmt.Errorf("%s is not a valid input for %s. it should be an IP string or a network name", singleElement, externalIPMapFlag)
			}
			if last == interfaceInputType && inputType == interfaceInputType {
				return fmt.Errorf("%s is not a valid input for %s. it should not contain two interface names", element, externalIPMapFlag)
			}
			last = inputType
		}
	}
	return nil
}

func parseInterfaceName(name string) error {

View on GitHub (pinned to 93e97f4bf1)

Solutions

Pair the interface with an IP: "1.2.3.4/eth0"
Resolve any hostname to an IP before passing it
Fix malformed IP literals

Example fix

# before
netbird up --external-ip-map eth0
# after
netbird up --external-ip-map "192.0.2.10/eth0"

Defensive patterns

Strategy: validation

Validate before calling

for _, e := range list {
	if !strings.Contains(e, "/") && net.ParseIP(e) == nil {
		return fmt.Errorf("single value %q must be a literal IP", e)
	}
}

Prevention

Interface-only values are invalid; always pair an interface with an IP
Resolve hostnames to IPs yourself before passing them

When it happens

Trigger: `netbird up --external-ip-map eth0` (interface name without a pairing IP) or "myhost.example.com" (DNS names are not resolved), or a malformed IP like "1.2.3.256".

Common situations: Users assuming an interface name alone is valid, or passing hostnames — the validator only accepts literal IPs.

Related errors

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/9bb50e34ea902115. Report an issue: GitHub.