groups spec [%s] contains the group '"any". This rule will i

Error message

groups spec [%s] contains the group '"any". This rule will ignore the specified cidr %s

What it means

If groups contain 'any' and a cidr is also specified, the cidr can never take effect because 'any' matches every group (and thus every peer), so the rule is rejected rather than silently ignoring the cidr.

Source

Thrown at firewall.go:1045

		return fmt.Errorf("groups spec [%s] contains the group '\"any\". This rule will ignore the other groups specified", r.Groups)
	}

	if r.Host == "any" {
		if !groupsEmpty {
			return fmt.Errorf("groups specified as %s, but host=any will match any host, regardless of groups", r.Groups)
		}

		if !cidrEmpty {
			return fmt.Errorf("cidr specified as %s, but host=any will match any host, regardless of cidr", r.Cidr)
		}
	}

	if groupsHasAny {
		if !hostEmpty && r.Host != "any" {
			return fmt.Errorf("groups spec [%s] contains the group '\"any\". This rule will ignore the specified host %s", r.Groups, r.Host)
		}
		if !cidrEmpty {
			return fmt.Errorf("groups spec [%s] contains the group '\"any\". This rule will ignore the specified cidr %s", r.Groups, r.Cidr)
		}
	}

	if r.Code != "" {
		return fmt.Errorf("code specified as [%s]. Support for 'code' will be dropped in a future release, as it has never been functional", r.Code)
	}

	//todo alert on cidr-any

	return nil
}

func parsePort(s string) (int32, int32, error) {
	const notAPort int32 = -2
	if s == "any" {
		return firewall.PortAny, firewall.PortAny, nil
	}
	if s == "fragment" {

View on GitHub (pinned to dd8f660c0a)

Solutions

Remove 'any' from groups if cidr scoping is intended
Or remove the cidr if the rule should match everything

Example fix

// before
groups: [any]
cidr: 192.168.0.0/16
// after
cidr: 192.168.0.0/16

Defensive patterns

Strategy: validation

Validate before calling

func checkAnyGroupsCidr(groups []string, cidr string) error {
    if slices.Contains(groups, "any") && cidr != "" && cidr != "any" {
        return fmt.Errorf("groups containing 'any' cannot restrict to cidr %s", cidr)
    }
    return nil
}

Type guard

func isAnyGroupsCidrConsistent(groups []string, cidr string) bool {
    return !slices.Contains(groups, "any") || cidr == "" || cidr == "any"
}

Try / catch

if err := loadFirewallConfig(cfg); err != nil {
    if strings.Contains(err.Error(), "ignore the specified cidr") {
        return fmt.Errorf("groups=any makes cidr moot: %w", err)
    }
    return err
}

Prevention

Never combine groups containing 'any' with a cidr
For cidr rules, omit groups entirely
Lint for 'any' group alongside cidr fields

When it happens

Trigger: A rule with groups containing 'any' and a non-empty cidr during rule translation, e.g. groups: [any], cidr: 192.168.0.0/16.

Common situations: Widening a cidr-scoped rule by adding 'any' to groups; template-generated rules that always emit a groups list including any.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/158346a3f242e20c. Report an issue: GitHub.