slackhq/nebula · error

entry %v.via in tun.unsafe_routes is not present

Error message

entry %v.via in tun.unsafe_routes is not present

What it means

Config validation error in parseUnsafeRoutes: the i+1-th entry has no `via` key. Unsafe routes must name a gateway (lighthouse or node IP) to forward matched traffic to; mtu/metric were validated but the mandatory via is absent.

Source

Thrown at overlay/route.go:207

		if !ok {
			rMetric = 0
		}

		metric, ok := rMetric.(int)
		if !ok {
			_, err = strconv.ParseInt(rMetric.(string), 10, 32)
			if err != nil {
				return nil, fmt.Errorf("entry %v.metric in tun.unsafe_routes is not an integer: %v", i+1, err)
			}
		}

		if metric < 0 || metric > math.MaxInt32 {
			return nil, fmt.Errorf("entry %v.metric in tun.unsafe_routes is not in range (0-%d) : %v", i+1, math.MaxInt32, metric)
		}

		rVia, ok := m["via"]
		if !ok {
			return nil, fmt.Errorf("entry %v.via in tun.unsafe_routes is not present", i+1)
		}

		var gateways routing.Gateways

		switch via := rVia.(type) {
		case string:
			viaIp, err := netip.ParseAddr(via)
			if err != nil {
				return nil, fmt.Errorf("entry %v.via in tun.unsafe_routes failed to parse address: %v", i+1, err)
			}

			gateways = routing.Gateways{routing.NewGateway(viaIp, 1)}

		case []any:
			gateways = make(routing.Gateways, len(via))
			for ig, v := range via {
				gatewayMap, ok := v.(map[string]any)
				if !ok {

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Add via: <gateway IP> (or a list of gateway mappings for multipath) to the entry

When it happens

Trigger: Thrown at overlay/route.go:207 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/25be48341b1609fb. Report an issue: GitHub.