cidr specified as %s, but host=any will match any host, rega

Error message

cidr specified as %s, but host=any will match any host, regardless of cidr

What it means

host: any matches any host regardless of cidr, so pairing a cidr with host 'any' is contradictory: the cidr would never take effect. The rule translator rejects this combination rather than silently ignoring the cidr.

Source

Thrown at firewall.go:1036

	hostEmpty := r.Host == ""
	cidrEmpty := r.Cidr == ""

	if (groupsEmpty && hostEmpty && cidrEmpty) == true {
		return nil //no content!
	}

	groupsHasAny := slices.Contains(r.Groups, "any")
	if groupsHasAny && len(r.Groups) > 1 {
		return fmt.Errorf("groups spec [%s] contains the group '\"any\". This rule will ignore the other groups specified", r.Groups)
	}

	if r.Host == "any" {
		if !groupsEmpty {
			return fmt.Errorf("groups specified as %s, but host=any will match any host, regardless of groups", r.Groups)
		}

		if !cidrEmpty {
			return fmt.Errorf("cidr specified as %s, but host=any will match any host, regardless of cidr", r.Cidr)
		}
	}

	if groupsHasAny {
		if !hostEmpty && r.Host != "any" {
			return fmt.Errorf("groups spec [%s] contains the group '\"any\". This rule will ignore the specified host %s", r.Groups, r.Host)
		}
		if !cidrEmpty {
			return fmt.Errorf("groups spec [%s] contains the group '\"any\". This rule will ignore the specified cidr %s", r.Groups, r.Cidr)
		}
	}

	if r.Code != "" {
		return fmt.Errorf("code specified as [%s]. Support for 'code' will be dropped in a future release, as it has never been functional", r.Code)
	}

	//todo alert on cidr-any

View on GitHub (pinned to dd8f660c0a)

Solutions

Drop host: any and keep only the cidr if you want cidr-scoped matching
Or drop the cidr if you truly want any host

Example fix

// before
host: any
cidr: 10.0.0.0/8
// after
cidr: 10.0.0.0/8

Defensive patterns

Strategy: validation

Validate before calling

func checkHostAnyCidr(r FirewallRuleConfig) error {
    if r.Host == "any" && r.Cidr != "" && r.Cidr != "any" {
        return fmt.Errorf("host=any cannot be combined with cidr %s", r.Cidr)
    }
    return nil
}

Type guard

func isHostAnyCidrConsistent(host, cidr string) bool {
    return host != "any" || cidr == "" || cidr == "any"
}

Try / catch

if err := loadFirewallConfig(cfg); err != nil {
    if strings.Contains(err.Error(), "host=any will match any host, regardless of cidr") {
        return fmt.Errorf("drop host=any or the cidr: %w", err)
    }
    return err
}

Prevention

For cidr-scoped rules, set cidr only and omit host
Use host=any only when the rule should truly match all hosts
Lint configs for host: any paired with cidr

When it happens

Trigger: A rule with host: any and a non-empty cidr field during rule translation (e.g. host: any, cidr: 10.0.0.0/8).

Common situations: Author intending 'any host in this cidr' — which requires cidr alone, not host: any; merged rule templates retaining host: any.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/62de39306cfb1d2b. Report an issue: GitHub.