nginx/nginx · critical

NGX_LOG_CRIT

NGX_LOG_CRIT

Error message

bind(%V) failed

What it means

bind() of the local address configured by proxy_bind (pc->local) failed before connecting upstream. Logged at CRIT and fatal for the attempt: socket closed, request fails for that peer. Typical errnos: EADDRNOTAVAIL (IP not assigned on any interface), EADDRINUSE (port already taken), EACCES (privileged port <1024 without CAP_NET_BIND_SERVICE).

Source

Thrown at src/event/ngx_event_connect.c:165

#if (NGX_LINUX)

        if (pc->type == SOCK_DGRAM && port != 0) {
            int  reuse_addr = 1;

            if (setsockopt(s, SOL_SOCKET, SO_REUSEADDR,
                           (const void *) &reuse_addr, sizeof(int))
                 == -1)
            {
                ngx_log_error(NGX_LOG_ALERT, pc->log, ngx_socket_errno,
                              "setsockopt(SO_REUSEADDR) failed");
                goto failed;
            }
        }

#endif

        if (bind(s, pc->local->sockaddr, pc->local->socklen) == -1) {
            ngx_log_error(NGX_LOG_CRIT, pc->log, ngx_socket_errno,
                          "bind(%V) failed", &pc->local->name);

            goto failed;
        }
    }

    if (type == SOCK_STREAM) {
        c->recv = ngx_recv;
        c->send = ngx_send;
        c->recv_chain = ngx_recv_chain;
        c->send_chain = ngx_send_chain;

        c->sendfile = 1;

        if (pc->sockaddr->sa_family == AF_UNIX) {
            c->tcp_nopush = NGX_TCP_NOPUSH_DISABLED;
            c->tcp_nodelay = NGX_TCP_NODELAY_DISABLED;

View on GitHub (pinned to 3f6f7824d4)

Solutions

1. Verify the IP exists: ip addr show; if missing, add it (ip addr add 10.0.0.5/32 dev eth0) or fix the directive to an address on the host
2. If EADDRINUSE, pick a free port or (UDP case) rely on SO_REUSEADDR sharing nginx already attempts
3. If EACCES on a low port, grant CAP_NET_BIND_SERVICE to the binary (setcap cap_net_bind_service+ep) or switch to a high port
4. Reload nginx after interface changes so the bind target is valid

Example fix

# before: bind fails, EADDRNOTAVAIL — IP not on this host
proxy_bind 10.0.0.5;

# after: add the address, or bind to an address that exists
# shell: ip addr add 10.0.0.5/32 dev eth0
proxy_bind 10.0.0.5;   # now valid

# preflight every proxy_bind target: address must exist locally, port must be bindable
for addr in $(nginx -T 2>/dev/null | sed -n 's/.*proxy_bind \([^ ;]*\);.*/\1/p' | grep -v '\$' | sed 's/:.*//'); do
  ip -o addr show | grep -qw "$addr" || echo "MISSING local IP: $addr"
done

When it happens

Trigger: proxy_bind 10.0.0.5; where 10.0.0.5 is not present on the box; proxy_bind with a port another process owns; binding to 0.0.0.0:53 without root; transparent-proxy misconfiguration binding arbitrary client IPs without the needed privileges.

Common situations: Config templated from another node with different interfaces; IP removed/floated away (VRRP failover) while nginx kept running;容器/portability mistakes binding low ports; docker networks where the bound CIDR is not on the container interface.

Related errors

• unknown query class %ui in DNS response
• unknown query type %ui in DNS response
• unexpected DNS response for %V
• connect() to %V failed
• NGX_LOG_WARN

AI-assisted analysis of nginx/nginx@3f6f7824d4 (2026-08-22). Data as JSON: /api/errors/13d166e96917790b. Report an issue: GitHub.