What causes "failed to parse --allow-config-from-cidr (%s) - %s" in nsqio/nsq?

Convert a single host IP to CIDR: append /32 for IPv4 (192.168.1.10/32) or /128 for IPv6

failed to parse --allow-config-from-cidr (%s) - %s

Error message

failed to parse --allow-config-from-cidr (%s) - %s

What it means

When --allow-config-from-cidr is a non-empty string, nsqadmin.New validates it with net.ParseCIDR before serving. The value must be true CIDR notation (an IP plus a /prefix length, e.g. 10.0.0.0/8), because nsqadmin uses the parsed network to authorize which clients may change config at runtime. A malformed value aborts startup.

Source

Thrown at nsqadmin/nsqadmin.go:109

	for _, address := range opts.NSQDHTTPAddresses {
		_, err := net.ResolveTCPAddr("tcp", address)
		if err != nil {
			return nil, fmt.Errorf("failed to resolve --nsqd-http-address (%s) - %s", address, err)
		}
	}

	if opts.ProxyGraphite {
		url, err := url.Parse(opts.GraphiteURL)
		if err != nil {
			return nil, fmt.Errorf("failed to parse --graphite-url (%s) - %s", opts.GraphiteURL, err)
		}
		n.graphiteURL = url
	}

	if opts.AllowConfigFromCIDR != "" {
		_, _, err := net.ParseCIDR(opts.AllowConfigFromCIDR)
		if err != nil {
			return nil, fmt.Errorf("failed to parse --allow-config-from-cidr (%s) - %s", opts.AllowConfigFromCIDR, err)
		}
	}

	opts.BasePath = normalizeBasePath(opts.BasePath)

	n.logf(LOG_INFO, version.String("nsqadmin"))

	var err error
	n.httpListener, err = net.Listen("tcp", n.getOpts().HTTPAddress)
	if err != nil {
		return nil, fmt.Errorf("listen (%s) failed - %s", n.getOpts().HTTPAddress, err)
	}

	return n, nil
}

func normalizeBasePath(p string) string {
	if len(p) == 0 {

View on GitHub (pinned to 85cf10c09c)

Solutions

Convert a single host IP to CIDR: append /32 for IPv4 (192.168.1.10/32) or /128 for IPv6
Use a proper network range such as 10.0.0.0/8 or 192.168.0.0/16
Verify with a quick Go one-liner or an online CIDR calculator that the prefix length matches the address family (0-32 IPv4, 0-128 IPv6)
Leave the flag empty if you want no CIDR-based config access restriction

Example fix

# before
--allow-config-from-cidr=192.168.1.10

# after
--allow-config-from-cidr=192.168.1.10/32

Defensive patterns

Strategy: validation

Validate before calling

if opts.AllowConfigFromCIDR != "" {
	if _, _, err := net.ParseCIDR(opts.AllowConfigFromCIDR); err != nil {
		log.Fatalf("bad --allow-config-from-cidr %q: %v", opts.AllowConfigFromCIDR, err)
	}
}

Try / catch

n, err := nsqadmin.New(opts)
if err != nil && strings.Contains(err.Error(), "failed to parse --allow-config-from-cidr") {
	// config error: correct to CIDR notation (ip/prefix) and restart
}
if err != nil {
	log.Fatal(err)
}

Prevention

Encode the allowed network as a real subnet in config management, never a bare host IP
Use /32 (IPv4) or /128 (IPv6) for single hosts
Lint nsqadmin flags in a pre-deploy check

When it happens

Trigger: Passing --allow-config-from-cidr=192.168.1.10 (bare IP, missing /32), a prefix out of range such as 10.0.0.0/33 or ::1/129, or plain garbage like 'office-network'. Any of these makes net.ParseCIDR return an error from nsqadmin.New.

Common situations: Operators naturally write a single IP where a CIDR is required; IPv6 prefixes with wrong bit counts; upgrading from configs that previously ignored this flag; leftover placeholder values in templated config files.

Understand the failure class

Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

AI-assisted analysis of nsqio/nsq@85cf10c09c (2026-08-16). Data as JSON: /api/errors/a2c424e38b5abe65. Report an issue: GitHub.