groups spec [ ] contains the group '"any". This rule will…

Error message

groups spec [%s] contains the group '"any". This rule will ignore the specified host %s

What it means

When a rule's groups include 'any' (which matches every group) and a specific host is also given (other than the literal 'any'), the host constraint is meaningless because the rule already matches all groups — and via groups, any peer. The translator rejects the rule to surface the contradiction.

Solutions

Remove 'any' from the groups list if the host restriction is intended
Or remove the host field if any-host matching is what you want

Example fix

// before
groups: [any]
host: laptop-1
// after
host: laptop-1

Defensive patterns

Strategy: validation

Validate before calling

func checkAnyGroupsHost(groups []string, host string) error {
    if slices.Contains(groups, "any") && host != "" && host != "any" {
        return fmt.Errorf("groups containing 'any' cannot restrict to host %s", host)
    }
    return nil
}

Type guard

func isAnyGroupsHostConsistent(groups []string, host string) bool {
    return !slices.Contains(groups, "any") || host == "" || host == "any"
}

Try / catch

if err := loadFirewallConfig(cfg); err != nil {
    if strings.Contains(err.Error(), "ignore the specified host") {
        return fmt.Errorf("groups=any makes host selector moot: %w", err)
    }
    return err
}

Prevention

Never combine groups containing 'any' with a specific host
Decide whether the rule is group-based or host-based and use one selector
Lint for the 'any' group alongside host fields

When it happens

Trigger: A rule with groups containing 'any' and a non-empty host other than 'any' during rule translation, e.g. groups: [any], host: laptop-1.

Common situations: Adding 'any' to a host-specific rule to widen it, not realizing groups=any makes the host selector moot.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/e3cecc09dc2d76e3. Report an issue: GitHub.

Appendix: source

Thrown at firewall.go:1042

	groupsHasAny := slices.Contains(r.Groups, "any")
	if groupsHasAny && len(r.Groups) > 1 {
		return fmt.Errorf("groups spec [%s] contains the group '\"any\". This rule will ignore the other groups specified", r.Groups)
	}

	if r.Host == "any" {
		if !groupsEmpty {
			return fmt.Errorf("groups specified as %s, but host=any will match any host, regardless of groups", r.Groups)
		}

		if !cidrEmpty {
			return fmt.Errorf("cidr specified as %s, but host=any will match any host, regardless of cidr", r.Cidr)
		}
	}

	if groupsHasAny {
		if !hostEmpty && r.Host != "any" {
			return fmt.Errorf("groups spec [%s] contains the group '\"any\". This rule will ignore the specified host %s", r.Groups, r.Host)
		}
		if !cidrEmpty {
			return fmt.Errorf("groups spec [%s] contains the group '\"any\". This rule will ignore the specified cidr %s", r.Groups, r.Cidr)
		}
	}

	if r.Code != "" {
		return fmt.Errorf("code specified as [%s]. Support for 'code' will be dropped in a future release, as it has never been functional", r.Code)
	}

	//todo alert on cidr-any

	return nil
}

func parsePort(s string) (int32, int32, error) {
	const notAPort int32 = -2
	if s == "any" {

View on GitHub (pinned to dd8f660c0a)