slackhq/nebula · error

failed to set default route MTU: %w

Error message

failed to set default route MTU: %w

What it means

Raised in tun.Activate when setDefaultRoute fails for one of the configured vpnNetworks. setDefaultRoute applies the route MTU for the default route covering the VPN CIDR; the wrapped error (%w) carries the underlying netlink/route failure.

Source

Thrown at overlay/tun_linux.go:496

	const modeNone = 1
	if err = netlink.LinkSetIP6AddrGenMode(link, modeNone); err != nil {
		t.l.Warn("Failed to disable link local address generation", "error", err)
	}

	if err = t.addIPs(link); err != nil {
		return err
	}

	// Bring up the interface
	ifrf.Flags = ifrf.Flags | unix.IFF_UP
	if err = ioctl(t.ioctlFd, unix.SIOCSIFFLAGS, uintptr(unsafe.Pointer(&ifrf))); err != nil {
		return fmt.Errorf("failed to bring the tun device up: %s", err)
	}

	//set route MTU
	for i := range t.vpnNetworks {
		if err = t.setDefaultRoute(t.vpnNetworks[i]); err != nil {
			return fmt.Errorf("failed to set default route MTU: %w", err)
		}
	}

	// Set the routes
	if err = t.addRoutes(false); err != nil {
		return err
	}

	// Run the interface
	ifrf.Flags = ifrf.Flags | unix.IFF_UP | unix.IFF_RUNNING
	if err = ioctl(t.ioctlFd, unix.SIOCSIFFLAGS, uintptr(unsafe.Pointer(&ifrf))); err != nil {
		return fmt.Errorf("failed to run tun device: %s", err)
	}

	return nil
}

func (t *tun) setMTU() {

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Check the wrapped error: 'no such route' means the host lacks a default route for that address family — add one or remove that family from vpnNetworks.
2. Verify a default route exists: ip route show default / ip -6 route show default.
3. Run with CAP_NET_ADMIN so route metrics/MTU can be modified.
4. Check tun.DefaultMTU is a sane value in config.
5. Unwrap with errors.Unwrap to see the netlink errno and target the specific fix.

Example fix

// before: vpnNetworks contains 0.0.0.0/0 but host has no IPv4 default route
// after — restrict to available family or add a default route
# ip route add default via 192.168.1.1
// or in config
tun: { routes: [] }

// require a default route for each vpnNetwork family before Activate
for _, p := range vpnNetworks {
    fam := netlink.FAMILY_V4
    if p.Addr().Is6() { fam = netlink.FAMILY_V6 }
    routes, err := netlink.RouteList(nil, fam)
    if err != nil || !hasDefault(routes) {
        return fmt.Errorf("no default route for %s; setDefaultRoute MTU will fail", p)
    }
}

if err := t.Activate(netstack); err != nil {
    if strings.Contains(err.Error(), "failed to set default route MTU") {
        log.Error("default route missing or unmodifiable", "cause", errors.Unwrap(err))
    }
}

When it happens

Trigger: Activate() with vpnNetworks configured and t.setDefaultRoute(cidr) returning an error — no matching default route exists in the route table, or the route modification is rejected (permissions, missing route).

Common situations: Host has no IPv4 (or no IPv6) default route while vpnNetworks includes that family; DefaultMTU misconfigured; lack of CAP_NET_ADMIN preventing route MTU changes.

Related errors

• failed to set mtu %v on the default route %v; %v
• no inside interface (tun)
• unable to create AF_ROUTE socket: %v
• failed to create route.RouteMessage: %w
• failed to write route.RouteMessage to socket: %w

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/da373f39304aff9f. Report an issue: GitHub.