%s is not a valid input for %s. it should not contain two in

Error message

%s is not a valid input for %s. it should not contain two interface names

What it means

validateNATExternalIPs tracks the type of each sub-element; a pair where both sides are interface names (interfaceInputType twice in a row) is rejected, because the mapping needs at least one concrete address to be meaningful for NAT.

Source

Thrown at client/cmd/up.go:759

		}

		subElements := strings.Split(element, "/")
		if len(subElements) > 2 {
			return fmt.Errorf("%s is not a valid input for %s. it should be formatted as \"String\" or \"String/String\"", element, externalIPMapFlag)
		}

		if len(subElements) == 1 && !isValidIP(subElements[0]) {
			return fmt.Errorf("%s is not a valid input for %s. it should be formatted as \"IP\" or \"IP/IP\", or \"IP/Interface Name\"", element, externalIPMapFlag)
		}

		last := 0
		for _, singleElement := range subElements {
			inputType, err := validateElement(singleElement)
			if err != nil {
				return fmt.Errorf("%s is not a valid input for %s. it should be an IP string or a network name", singleElement, externalIPMapFlag)
			}
			if last == interfaceInputType && inputType == interfaceInputType {
				return fmt.Errorf("%s is not a valid input for %s. it should not contain two interface names", element, externalIPMapFlag)
			}
			last = inputType
		}
	}
	return nil
}

func parseInterfaceName(name string) error {
	if runtime.GOOS != "darwin" {
		return nil
	}

	if strings.HasPrefix(name, "utun") {
		return nil
	}

	return fmt.Errorf("invalid interface name %s. Please use the prefix utun followed by a number on MacOS. e.g., utun1 or utun199", name)
}

View on GitHub (pinned to 93e97f4bf1)

Solutions

Put an IP on one side: "1.2.3.4/eth0"
If two mappings were intended, pass them as separate comma-separated elements

Example fix

# before
netbird up --external-ip-map "eth0/wlan0"
# after
netbird up --external-ip-map "192.0.2.10/eth0"

Defensive patterns

Strategy: validation

Validate before calling

for _, e := range list {
	parts := strings.Split(e, "/")
	if len(parts) == 2 && net.ParseIP(parts[0]) == nil && net.ParseIP(parts[1]) == nil {
		return fmt.Errorf("%q pairs two interface names; one side must be an IP", e)
	}
}

Prevention

Mentally model the flag as 'which IP should peers see' — an address is always required

When it happens

Trigger: Values like "eth0/wlan0" — two interface names with no IP on either side of the '/'.

Common situations: Misunderstanding the flag as a general interface pair, or accidentally swapping the intended IP for a second interface name.

Related errors

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/e7db2050e0a6f139. Report an issue: GitHub.