entry .gateway in tun.unsafe_routes[%v].via[%v] failed to pa

Error message

entry .gateway in tun.unsafe_routes[%v].via[%v] failed to parse address: %v

What it means

Configuration validation error in parseUnsafeRoutes for multipath unsafe routes. The 'gateway' string in a via list entry failed netip.ParseAddr, meaning it is not a valid IP address (bad syntax, hostname given instead of an IP, or an invalid IPv6 literal). The wrapped netip error gives the exact parse failure; the route entry is rejected.

Source

Thrown at overlay/route.go:241

			for ig, v := range via {
				gatewayMap, ok := v.(map[string]any)
				if !ok {
					return nil, fmt.Errorf("entry %v in tun.unsafe_routes[%v].via is invalid", i+1, ig+1)
				}

				rGateway, ok := gatewayMap["gateway"]
				if !ok {
					return nil, fmt.Errorf("entry .gateway in tun.unsafe_routes[%v].via[%v] is not present", i+1, ig+1)
				}

				parsedGateway, ok := rGateway.(string)
				if !ok {
					return nil, fmt.Errorf("entry .gateway in tun.unsafe_routes[%v].via[%v] is not a string", i+1, ig+1)
				}

				gatewayIp, err := netip.ParseAddr(parsedGateway)
				if err != nil {
					return nil, fmt.Errorf("entry .gateway in tun.unsafe_routes[%v].via[%v] failed to parse address: %v", i+1, ig+1, err)
				}

				rGatewayWeight, ok := gatewayMap["weight"]
				if !ok {
					rGatewayWeight = 1
				}

				gatewayWeight, ok := rGatewayWeight.(int)
				if !ok {
					_, err = strconv.ParseInt(rGatewayWeight.(string), 10, 32)
					if err != nil {
						return nil, fmt.Errorf("entry .weight in tun.unsafe_routes[%v].via[%v] is not an integer", i+1, ig+1)
					}
				}

				if gatewayWeight < 1 || gatewayWeight > math.MaxInt32 {
					return nil, fmt.Errorf("entry .weight in tun.unsafe_routes[%v].via[%v] is not in range (1-%d) : %v", i+1, ig+1, math.MaxInt32, gatewayWeight)
				}

View on GitHub (pinned to dd8f660c0a)

Solutions

Use a valid literal IP address for gateway

Defensive patterns

Strategy: validation

When it happens

Trigger: Thrown at overlay/route.go:241 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/d8f13ea759cfa9ab. Report an issue: GitHub.