What causes "failed to set ip interface: %w" in slackhq/nebula?

Retry activation after confirming the adapter is present (often transient)

failed to set ip interface: %w

Error message

failed to set ip interface: %w

What it means

addRoutes successfully read the IPv4 IP interface but ipif.Set() (applying NLMTU, metric, and forwarding flags) was rejected by Windows. The library wraps the winipcfg error to indicate the interface property update failed.

Source

Thrown at overlay/tun_windows.go:225

			if r.Cidr.Bits() == 0 && r.Cidr.Addr().BitLen() == 32 {
				foundDefault4 = true
			}
		}
	}

	ipif, err := luid.IPInterface(windows.AF_INET)
	if err != nil {
		return fmt.Errorf("failed to get ip interface: %w", err)
	}

	ipif.NLMTU = uint32(t.MTU)
	if foundDefault4 {
		ipif.UseAutomaticMetric = false
		ipif.Metric = 0
	}

	if err := ipif.Set(); err != nil {
		return fmt.Errorf("failed to set ip interface: %w", err)
	}
	return nil
}

func (t *winTun) removeRoutes(routes []Route) error {
	luid := winipcfg.LUID(t.tun.LUID())

	for _, r := range routes {
		if !r.Install {
			continue
		}

		// See comment on luid.AddRoute
		err := luid.DeleteRoute(r.Cidr, unspecifiedNextHop(r.Cidr))
		if err != nil {
			t.l.Error("Failed to remove route", "error", err, "route", r)
		} else {
			t.l.Info("Removed route", "route", r)

View on GitHub (pinned to dd8f660c0a)

Solutions

Retry activation after confirming the adapter is present (often transient)
Check the configured MTU is reasonable (e.g. 1300-1400)
Stop other VPN clients or metric-override tools
Run as Administrator so interface property changes are permitted
Inspect the wrapped winipcfg error code for the exact NDIS/OS reason

Example fix

// before
tun:
  mtu: 9001
// after
tun:
  mtu: 1300

Defensive patterns

Strategy: validation

Validate before calling

mtu := cfg.Tun.MTU
if mtu < 576 || mtu > 1400 {
    return fmt.Errorf("MTU %d out of safe range for wintun", mtu)
}

Try / catch

if err := tun.Activate(); err != nil {
    if strings.Contains(err.Error(), "failed to set ip interface") {
        // drop custom metric/MTU and retry activation
    }
    return err
}

Prevention

Use a standard MTU (e.g. 1300)
Run as Administrator so interface settings apply
Don't run competing VPN clients that override metrics
Retry activation once; the failure is often transient

When it happens

Trigger: ipif.Set() returns an error during Activate() or reload() — commonly when the interface is gone, or when setting UseAutomaticMetric=false/Metric=0 is denied because another process owns interface settings.

Common situations: Group policy or security software locking interface metrics; adapter removed mid-config; MTU value out of allowed range; concurrent route managers (other VPNs) fighting over the interface.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/244104f0ecdacf83. Report an issue: GitHub.