What causes "failed to set route for vpn network %v: %w" in slackhq/nebula?

Check the wrapped addRoute error for the kernel reason (EEXIST means route already present — safe to delete stale route)

slackhq/nebula · error

failed to set route for vpn network %v: %w

Error message

failed to set route for vpn network %v: %w

What it means

After successfully assigning the address, addIp calls addRoute to install a kernel route for the vpn network. If addRoute fails (socket creation or route message rejected), the error is wrapped with this message. The address is set but routing is not, so the tunnel will not pass traffic.

Source

Thrown at overlay/tun_openbsd.go:256

		req.MaskAddr = unix.RawSockaddrInet4{
			Len:    unix.SizeofSockaddrInet4,
			Family: unix.AF_INET,
			Addr:   prefixToMask(cidr).As4(),
		}

		s, err := unix.Socket(unix.AF_INET, unix.SOCK_DGRAM, unix.IPPROTO_IP)
		if err != nil {
			return err
		}
		defer syscall.Close(s)

		if err := ioctl(uintptr(s), unix.SIOCAIFADDR, uintptr(unsafe.Pointer(&req))); err != nil {
			return fmt.Errorf("failed to set tun address %s: %s", cidr.Addr(), err)
		}

		err = addRoute(cidr, t.vpnNetworks)
		if err != nil {
			return fmt.Errorf("failed to set route for vpn network %v: %w", cidr, err)
		}

		return nil
	}

	if cidr.Addr().Is6() {
		var req ifreqAlias6
		req.Name = t.deviceBytes()
		req.Addr = unix.RawSockaddrInet6{
			Len:    unix.SizeofSockaddrInet6,
			Family: unix.AF_INET6,
			Addr:   cidr.Addr().As16(),
		}
		req.PrefixMask = unix.RawSockaddrInet6{
			Len:    unix.SizeofSockaddrInet6,
			Family: unix.AF_INET6,
			Addr:   prefixToMask(cidr).As16(),
		}

View on GitHub (pinned to dd8f660c0a)

Solutions

Check the wrapped addRoute error for the kernel reason (EEXIST means route already present — safe to delete stale route)
Run with sufficient privileges to modify the routing table
Remove conflicting/stale routes: `route delete <vpn-net>`
Ensure the vpn networks in config match the certificate networks

Example fix

# before (stale route)
$ route -n get 10.0.0.0/24
# after
$ doas route delete 10.0.0.0/24 && doas ./nebula -config config.yaml

Defensive patterns

Strategy: try-catch

Validate before calling

out, _ := exec.Command("route", "-n", "show").Output()
if strings.Contains(string(out), vpnNet.String()) {
    log.Warn("route already present; removing stale route", "net", vpnNet)
}

Try / catch

err := t.Activate()
if err != nil && strings.Contains(err.Error(), "failed to set route for vpn network") {
    if strings.Contains(err.Error(), "File exists") {
        // delete stale route and retry once
    }
    return err
}

Prevention

Clean stale routes from previous runs before starting
Avoid running multiple VPN daemons claiming the same networks
Keep config networks aligned with certificate networks

When it happens

Trigger: IPv4 addIp where addRoute returns an error — e.g. AF_ROUTE socket creation failed due to privileges, or the kernel rejected RTM_ADD (EEXIST, EINVAL, unreachable gateway).

Common situations: Route already present from a previous run; non-root process lacking route table access; conflicting routes from other VPN software.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/6d75d46cfbb20f1f. Report an issue: GitHub.