slackhq/nebula · error

entry %v in tun.unsafe_routes[%v].via is invalid

Error message

entry %v in tun.unsafe_routes[%v].via is invalid

What it means

Config validation error in parseUnsafeRoutes: `via` was given as a list (multipath), but its ig+1-th element did not type-assert to map[string]any — a scalar where a {gateway, weight} mapping was expected.

Source

Thrown at overlay/route.go:226

		}

		var gateways routing.Gateways

		switch via := rVia.(type) {
		case string:
			viaIp, err := netip.ParseAddr(via)
			if err != nil {
				return nil, fmt.Errorf("entry %v.via in tun.unsafe_routes failed to parse address: %v", i+1, err)
			}

			gateways = routing.Gateways{routing.NewGateway(viaIp, 1)}

		case []any:
			gateways = make(routing.Gateways, len(via))
			for ig, v := range via {
				gatewayMap, ok := v.(map[string]any)
				if !ok {
					return nil, fmt.Errorf("entry %v in tun.unsafe_routes[%v].via is invalid", i+1, ig+1)
				}

				rGateway, ok := gatewayMap["gateway"]
				if !ok {
					return nil, fmt.Errorf("entry .gateway in tun.unsafe_routes[%v].via[%v] is not present", i+1, ig+1)
				}

				parsedGateway, ok := rGateway.(string)
				if !ok {
					return nil, fmt.Errorf("entry .gateway in tun.unsafe_routes[%v].via[%v] is not a string", i+1, ig+1)
				}

				gatewayIp, err := netip.ParseAddr(parsedGateway)
				if err != nil {
					return nil, fmt.Errorf("entry .gateway in tun.unsafe_routes[%v].via[%v] failed to parse address: %v", i+1, ig+1, err)
				}

				rGatewayWeight, ok := gatewayMap["weight"]

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Write each via list element as a mapping, e.g. - gateway: 10.0.0.1, weight: 2

When it happens

Trigger: Thrown at overlay/route.go:226 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/bb7f5f7a3ea1a8d3. Report an issue: GitHub.