slackhq/nebula · error

failed to set tun address %s: %s

Error message

failed to set tun address %s: %s

What it means

addIp configures an IPv4 address on the tun interface via the SIOCAIFADDR ioctl. If the ioctl returns an error, it is wrapped with this message including the requested address. Typical causes are the interface not being up, an invalid/broadcast-inconsistent ifreq structure, or insufficient privileges.

Source

Thrown at overlay/tun_openbsd.go:251

		req.DstAddr = unix.RawSockaddrInet4{
			Len:    unix.SizeofSockaddrInet4,
			Family: unix.AF_INET,
			Addr:   cidr.Addr().As4(),
		}
		req.MaskAddr = unix.RawSockaddrInet4{
			Len:    unix.SizeofSockaddrInet4,
			Family: unix.AF_INET,
			Addr:   prefixToMask(cidr).As4(),
		}

		s, err := unix.Socket(unix.AF_INET, unix.SOCK_DGRAM, unix.IPPROTO_IP)
		if err != nil {
			return err
		}
		defer syscall.Close(s)

		if err := ioctl(uintptr(s), unix.SIOCAIFADDR, uintptr(unsafe.Pointer(&req))); err != nil {
			return fmt.Errorf("failed to set tun address %s: %s", cidr.Addr(), err)
		}

		err = addRoute(cidr, t.vpnNetworks)
		if err != nil {
			return fmt.Errorf("failed to set route for vpn network %v: %w", cidr, err)
		}

		return nil
	}

	if cidr.Addr().Is6() {
		var req ifreqAlias6
		req.Name = t.deviceBytes()
		req.Addr = unix.RawSockaddrInet6{
			Len:    unix.SizeofSockaddrInet6,
			Family: unix.AF_INET6,
			Addr:   cidr.Addr().As16(),
		}

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Run as root or grant the process the needed privileges (staff/daemon with appropriate perms)
2. Verify the IPv4 CIDR in the certificate/config is valid and unique
3. Confirm the tun interface exists and is up before addIp
4. Check the wrapped errno in the message for the specific kernel reason

Example fix

# before
$ ./nebula -config config.yaml   # as regular user
# after
$ doas ./nebula -config config.yaml

cidr := cfgVpnNetworks[0]
if !cidr.Addr().Is4() { return fmt.Errorf("expected IPv4 prefix") }
if os.Geteuid() != 0 { return fmt.Errorf("needs root to set interface address") }

if err := t.Activate(); err != nil {
    var ifaceErr *fmt.Errorf
    if errors.As(err, &ifaceErr) && strings.Contains(err.Error(), "failed to set tun address") {
        log.Error("check privileges and CIDR validity", "err", err)
    }
    return err
}

When it happens

Trigger: t.Activate() iterating vpnNetworks where an IPv4 prefix fails the SIOCAIFADDR ioctl — e.g. running without root, or an address conflicting with an existing assignment.

Common situations: Running nebula as non-root on OpenBSD; duplicate VPN addresses across hosts; netmask issues in the tun.config_l group.

Related errors

• failed to set tun v4 address: %s
• failed to set tun address %s: %s
• failed to set route for vpn network %v: %w
• failed to set tun mtu: %w
• unable to determine IP version from packet

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/27df224f87281ffd. Report an issue: GitHub.