What causes "invalid port: %s: %w" in slackhq/nebula?

Set the port to a bare integer (port: 4242) or a clean numeric string (port: "4242")

invalid port: %s: %w

Error message

invalid port: %s: %w

What it means

This error is returned by newCalculatedRemotesEntryFromConfig when the 'port' value in a calculated_remotes entry is a string that cannot be converted to an integer with strconv.Atoi. The string form is allowed in YAML, but it must contain only digits representing a valid port number.

Source

Thrown at calculated_remote.go:156

		return nil, fmt.Errorf("invalid mask (type %T): %v", rawValue, rawValue)
	}
	maskCidr, err := netip.ParsePrefix(rawMask)
	if err != nil {
		return nil, fmt.Errorf("invalid mask: %s", rawMask)
	}

	var port int
	rawValue = rawMap["port"]
	if rawValue == nil {
		return nil, fmt.Errorf("missing port: %v", rawMap)
	}
	switch v := rawValue.(type) {
	case int:
		port = v
	case string:
		port, err = strconv.Atoi(v)
		if err != nil {
			return nil, fmt.Errorf("invalid port: %s: %w", v, err)
		}
	default:
		return nil, fmt.Errorf("invalid port (type %T): %v", rawValue, rawValue)
	}

	return newCalculatedRemote(cidr, maskCidr, port)
}

View on GitHub (pinned to dd8f660c0a)

Solutions

Set the port to a bare integer (port: 4242) or a clean numeric string (port: "4242")
Strip whitespace, quotes, or non-digit characters from the port value
Ensure the number is within the valid port range (1-65535)

Example fix

// before
calculated_remotes:
  - mask: 10.0.0.0/8
    port: "44x2"
// after
calculated_remotes:
  - mask: 10.0.0.0/8
    port: 4242

Defensive patterns

Strategy: validation

Validate before calling

func validPortString(v string) bool {
    n, err := strconv.Atoi(strings.TrimSpace(v))
    return err == nil && n > 0 && n <= 65535
}

Type guard

func asPortString(raw any) (string, bool) {
    s, ok := raw.(string)
    if !ok || !validPortString(s) {
        return "", false
    }
    return s, true
}

Try / catch

if err != nil {
    var numErr *strconv.NumError
    if errors.As(err, &numErr) || strings.Contains(err.Error(), "invalid port") {
        log.Fatalf("calculated_remotes port must be numeric: %v", err)
    }
    return err
}

Prevention

Prefer unquoted integer ports (port: 4242) in YAML
Trim whitespace and strip comments/units from port strings
Range-check ports 1-65535 during config linting

When it happens

Trigger: Setting port as a non-numeric string in a calculated_remotes entry, e.g. port: "4242x", port: "port", or port: "" — Atoi fails and the underlying strconv error is wrapped.

Common situations: Typos in the port number, accidental leftover placeholder text, or locale/whitespace characters inside quoted strings in the YAML config.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/6f7dfa068c79e46d. Report an issue: GitHub.