slackhq/nebula · error

config ` ` has invalid CIDR: .

Error message

config `%s` has invalid CIDR: %s. %w

What it means

newAllowList validates that each key in an allow-list config block is a valid CIDR prefix using netip.ParsePrefix. If the key is not parseable as an IP prefix (missing mask, bad IP, hostnames), construction fails with this error, wrapping the underlying parse error.

Solutions

1. Correct the CIDR key to valid prefix notation, e.g. 10.0.0.0/8
2. Ensure a prefix length is present (/24, /32, /64, etc.)
3. Use the wrapped net.ParsePrefix error in the message to see the exact parse failure

Example fix

// before
remote_allow_ranges:
  192.168.1.1: true
// after
remote_allow_ranges:
  192.168.1.0/24: true

func validCIDRs(keys []string) error {
	for _, k := range keys {
		if _, err := netip.ParsePrefix(k); err != nil {
			return fmt.Errorf("bad CIDR %q: %w", k, err)
		}
	}
	return nil
}

allowList, err := NewRemoteAllowListFromConfig(k, v, itf)
if err != nil {
	return fmt.Errorf("invalid allow list config: %w", err)
}

When it happens

Trigger: Calling newAllowListFromConfig or NewRemoteAllowListFromConfig with a key like "10.0.0.0/33", "192.168.1.1" (no prefix length), or a hostname instead of a CIDR.

Common situations: Typos in CIDR notation, forgotten /mask suffix, IPv6 written with wrong syntax, or using interface names/hostnames where only CIDRs are accepted.

Related errors

• config ` ` has invalid CIDR
• entry .route in tun.routes failed to parse
• invalid mask
• a device name in the format of /dev/tunN must be specified
• cidr specified as , but host=any will match any host…

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/b55e1ee5e3274194. Report an issue: GitHub.

Appendix: source

Thrown at allow_list.go:121

	for rawCIDR, rawValue := range rawMap {
		if handleKey != nil {
			handled, err := handleKey(rawCIDR, rawValue)
			if err != nil {
				return nil, err
			}
			if handled {
				continue
			}
		}

		value, ok := config.AsBool(rawValue)
		if !ok {
			return nil, fmt.Errorf("config `%s` has invalid value (type %T): %v", k, rawValue, rawValue)
		}

		ipNet, err := netip.ParsePrefix(rawCIDR)
		if err != nil {
			return nil, fmt.Errorf("config `%s` has invalid CIDR: %s. %w", k, rawCIDR, err)
		}

		ipNet = netip.PrefixFrom(ipNet.Addr().Unmap(), ipNet.Bits())

		tree.Insert(ipNet, value)

		maskBits := ipNet.Bits()

		var rules *allowListRules
		if ipNet.Addr().Is4() {
			rules = &rules4
		} else {
			rules = &rules6
		}

		if rules.firstValue {
			rules.allValues = value
			rules.firstValue = false

View on GitHub (pinned to dd8f660c0a)