slackhq/nebula · error

entry %v in tun.routes is invalid

Error message

entry %v in tun.routes is invalid

What it means

One of the elements inside tun.routes is not an object (map). parseRoutes iterates each array entry and asserts it is map[string]any before reading its mtu/route keys; the 1-based entry index is reported. The library requires each route entry to be a structured object.

Source

Thrown at overlay/route.go:91

	r := c.Get("tun.routes")
	if r == nil {
		return []Route{}, nil
	}

	rawRoutes, ok := r.([]any)
	if !ok {
		return nil, fmt.Errorf("tun.routes is not an array")
	}

	if len(rawRoutes) < 1 {
		return []Route{}, nil
	}

	routes := make([]Route, len(rawRoutes))
	for i, r := range rawRoutes {
		m, ok := r.(map[string]any)
		if !ok {
			return nil, fmt.Errorf("entry %v in tun.routes is invalid", i+1)
		}

		rMtu, ok := m["mtu"]
		if !ok {
			return nil, fmt.Errorf("entry %v.mtu in tun.routes is not present", i+1)
		}

		mtu, ok := rMtu.(int)
		if !ok {
			mtu, err = strconv.Atoi(rMtu.(string))
			if err != nil {
				return nil, fmt.Errorf("entry %v.mtu in tun.routes is not an integer: %v", i+1, err)
			}
		}

		if mtu < 500 {
			return nil, fmt.Errorf("entry %v.mtu in tun.routes is below 500: %v", i+1, mtu)
		}

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Make every tun.routes entry an object with mtu and route keys
2. Convert string entries to objects: replace "10.0.0.0/24" with {mtu: 1300, route: "10.0.0.0/24"}
3. Use the reported entry index (entry %v) to locate the offending item in the array
4. Validate the config against the expected routes schema before applying

Example fix

// before
tun:
  routes:
    - 10.0.0.0/24
// after
tun:
  routes:
    - mtu: 1300
      route: 10.0.0.0/24

for i, e := range routes.([]any) {
    if _, ok := e.(map[string]any); !ok {
        return fmt.Errorf("tun.routes entry %d must be an object with mtu and route", i+1)
    }
}

func isRouteEntry(v any) bool {
    _, ok := v.(map[string]any)
    return ok
}

When it happens

Trigger: Calling getAllRoutesFromConfig when tun.routes contains a bare string, number, or nested array instead of an object, e.g. tun.routes: ["10.0.0.0/24"] or mixed-type entries.

Common situations: Users familiar with other VPN tools writing routes as plain CIDR strings; templating errors that inject scalars into the list; copy-paste from documentation showing comma-separated route strings.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• Empty configuration
• group should contain a single value, an array with more than
• stats.host can not be empty
• stats.listen should not be empty
• stats.path should not be empty

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/750453610c9d4dc6. Report an issue: GitHub.