groups spec [%s] contains the group '"any". This rule will i

Error message

groups spec [%s] contains the group '"any". This rule will ignore the specified host %s

What it means

When a rule's groups include 'any' (which matches every group) and a specific host is also given (other than the literal 'any'), the host constraint is meaningless because the rule already matches all groups — and via groups, any peer. The translator rejects the rule to surface the contradiction.

Source

Thrown at firewall.go:1042

	groupsHasAny := slices.Contains(r.Groups, "any")
	if groupsHasAny && len(r.Groups) > 1 {
		return fmt.Errorf("groups spec [%s] contains the group '\"any\". This rule will ignore the other groups specified", r.Groups)
	}

	if r.Host == "any" {
		if !groupsEmpty {
			return fmt.Errorf("groups specified as %s, but host=any will match any host, regardless of groups", r.Groups)
		}

		if !cidrEmpty {
			return fmt.Errorf("cidr specified as %s, but host=any will match any host, regardless of cidr", r.Cidr)
		}
	}

	if groupsHasAny {
		if !hostEmpty && r.Host != "any" {
			return fmt.Errorf("groups spec [%s] contains the group '\"any\". This rule will ignore the specified host %s", r.Groups, r.Host)
		}
		if !cidrEmpty {
			return fmt.Errorf("groups spec [%s] contains the group '\"any\". This rule will ignore the specified cidr %s", r.Groups, r.Cidr)
		}
	}

	if r.Code != "" {
		return fmt.Errorf("code specified as [%s]. Support for 'code' will be dropped in a future release, as it has never been functional", r.Code)
	}

	//todo alert on cidr-any

	return nil
}

func parsePort(s string) (int32, int32, error) {
	const notAPort int32 = -2
	if s == "any" {

View on GitHub (pinned to dd8f660c0a)

Solutions

Remove 'any' from the groups list if the host restriction is intended
Or remove the host field if any-host matching is what you want

Example fix

// before
groups: [any]
host: laptop-1
// after
host: laptop-1

Defensive patterns

Strategy: validation

Validate before calling

func checkAnyGroupsHost(groups []string, host string) error {
    if slices.Contains(groups, "any") && host != "" && host != "any" {
        return fmt.Errorf("groups containing 'any' cannot restrict to host %s", host)
    }
    return nil
}

Type guard

func isAnyGroupsHostConsistent(groups []string, host string) bool {
    return !slices.Contains(groups, "any") || host == "" || host == "any"
}

Try / catch

if err := loadFirewallConfig(cfg); err != nil {
    if strings.Contains(err.Error(), "ignore the specified host") {
        return fmt.Errorf("groups=any makes host selector moot: %w", err)
    }
    return err
}

Prevention

Never combine groups containing 'any' with a specific host
Decide whether the rule is group-based or host-based and use one selector
Lint for the 'any' group alongside host fields

When it happens

Trigger: A rule with groups containing 'any' and a non-empty host other than 'any' during rule translation, e.g. groups: [any], host: laptop-1.

Common situations: Adding 'any' to a host-specific rule to widen it, not realizing groups=any makes the host selector moot.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/e3cecc09dc2d76e3. Report an issue: GitHub.