slackhq/nebula · error

config `%s` contains both true and false rules, but no defau

Error message

config `%s` contains both true and false rules, but no default set for ::/0

What it means

Same ambiguity check as the IPv4 case but for IPv6: an allow list mixing true and false rules needs an explicit default ::/0 entry, otherwise the decision for unmatched IPv6 addresses is undefined and newAllowList fails.

Source

Thrown at allow_list.go:164

		// Check if this is 0.0.0.0/0 or ::/0
		if maskBits == 0 {
			rules.defaultSet = true
		}
	}

	if !rules4.defaultSet {
		if rules4.allValuesMatch {
			tree.Insert(netip.PrefixFrom(netip.IPv4Unspecified(), 0), !rules4.allValues)
		} else {
			return nil, fmt.Errorf("config `%s` contains both true and false rules, but no default set for 0.0.0.0/0", k)
		}
	}

	if !rules6.defaultSet {
		if rules6.allValuesMatch {
			tree.Insert(netip.PrefixFrom(netip.IPv6Unspecified(), 0), !rules6.allValues)
		} else {
			return nil, fmt.Errorf("config `%s` contains both true and false rules, but no default set for ::/0", k)
		}
	}

	return &AllowList{cidrTree: tree}, nil
}

func getAllowListInterfaces(k string, v any) ([]AllowListNameRule, error) {
	var nameRules []AllowListNameRule

	rawRules, ok := v.(map[string]any)
	if !ok {
		return nil, fmt.Errorf("config `%s.interfaces` is invalid (type %T): %v", k, v, v)
	}

	firstEntry := true
	var allValues bool
	for name, rawAllow := range rawRules {
		allow, ok := config.AsBool(rawAllow)

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Add an explicit ::/0: true or ::/0: false entry
2. Or make all IPv6 rules a single value so the default is unambiguous

Example fix

// before
remote_allow_ranges:
  0.0.0.0/0: false
  fd00::/8: true
  2001:db8::/32: false
// after
remote_allow_ranges:
  0.0.0.0/0: false
  ::/0: false
  fd00::/8: true
  2001:db8::/32: false

func hasV6Default(m map[string]any) bool {
	_, ok := m["::/0"]
	return ok
}

When it happens

Trigger: newAllowListFromConfig / getRemoteAllowRanges where no ::/0 key exists and the IPv6 CIDR rules include both true and false values.

Common situations: Dual-stack configs where the admin added an IPv4 default (0.0.0.0/0) but forgot the IPv6 default (::/0).

Related errors

• config `%s` has invalid value (type %T): %v
• config `%s` contains both true and false rules, but no defau
• group should contain a single value, an array with more than
• no firewall rules
• ErrIPv6PacketTooShort

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/d375c1808bf3314c. Report an issue: GitHub.