slackhq/nebula · error

entry %v.mtu in tun.unsafe_routes is below 500: %v

Error message

entry %v.mtu in tun.unsafe_routes is below 500: %v

What it means

Config validation error in parseUnsafeRoutes: the i+1-th entry sets a non-zero mtu below the enforced minimum of 500, which would produce a route with an unusably small MTU. mtu == 0 (unset) is allowed and means default.

Source

Thrown at overlay/route.go:184

	routes := make([]Route, len(rawRoutes))
	for i, r := range rawRoutes {
		m, ok := r.(map[string]any)
		if !ok {
			return nil, fmt.Errorf("entry %v in tun.unsafe_routes is invalid", i+1)
		}

		var mtu int
		if rMtu, ok := m["mtu"]; ok {
			mtu, ok = rMtu.(int)
			if !ok {
				mtu, err = strconv.Atoi(rMtu.(string))
				if err != nil {
					return nil, fmt.Errorf("entry %v.mtu in tun.unsafe_routes is not an integer: %v", i+1, err)
				}
			}

			if mtu != 0 && mtu < 500 {
				return nil, fmt.Errorf("entry %v.mtu in tun.unsafe_routes is below 500: %v", i+1, mtu)
			}
		}

		rMetric, ok := m["metric"]
		if !ok {
			rMetric = 0
		}

		metric, ok := rMetric.(int)
		if !ok {
			_, err = strconv.ParseInt(rMetric.(string), 10, 32)
			if err != nil {
				return nil, fmt.Errorf("entry %v.metric in tun.unsafe_routes is not an integer: %v", i+1, err)
			}
		}

		if metric < 0 || metric > math.MaxInt32 {
			return nil, fmt.Errorf("entry %v.metric in tun.unsafe_routes is not in range (0-%d) : %v", i+1, math.MaxInt32, metric)

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Raise the entry's mtu to 500 or above
2. Remove the mtu key to use the default

When it happens

Trigger: Thrown at overlay/route.go:184 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/08313702e0d28b6d. Report an issue: GitHub.