slackhq/nebula · error

missing port: %v

Error message

missing port: %v

What it means

This error is returned by newCalculatedRemotesEntryFromConfig when a calculated_remotes config entry has no 'port' key. A calculated remote entry must specify the UDP port that masked hosts will be dialed on; without it Nebula cannot build the entry and aborts config parsing.

Source

Thrown at calculated_remote.go:148

	}

	rawValue := rawMap["mask"]
	if rawValue == nil {
		return nil, fmt.Errorf("missing mask: %v", rawMap)
	}
	rawMask, ok := rawValue.(string)
	if !ok {
		return nil, fmt.Errorf("invalid mask (type %T): %v", rawValue, rawValue)
	}
	maskCidr, err := netip.ParsePrefix(rawMask)
	if err != nil {
		return nil, fmt.Errorf("invalid mask: %s", rawMask)
	}

	var port int
	rawValue = rawMap["port"]
	if rawValue == nil {
		return nil, fmt.Errorf("missing port: %v", rawMap)
	}
	switch v := rawValue.(type) {
	case int:
		port = v
	case string:
		port, err = strconv.Atoi(v)
		if err != nil {
			return nil, fmt.Errorf("invalid port: %s: %w", v, err)
		}
	default:
		return nil, fmt.Errorf("invalid port (type %T): %v", rawValue, rawValue)
	}

	return newCalculatedRemote(cidr, maskCidr, port)
}

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Add the required 'port' key to the calculated_remotes entry, e.g. port: 4242
2. Confirm the port matches the UDP port your lighthouses actually listen on
3. Review the Nebula calculated_remotes documentation for the required entry schema

Example fix

// before
calculated_remotes:
  - mask: 10.0.0.0/8
// after
calculated_remotes:
  - mask: 10.0.0.0/8
    port: 4242

func entryHasPort(entry map[string]any) bool {
    v, ok := entry["port"]
    return ok && v != nil
}
// check every calculated_remotes entry before parsing

func hasPort(m map[string]any) bool {
    p, present := m["port"]
    return present && p != nil
}

if err := newCalculatedRemotesListFromConfig(raw); err != nil {
    if strings.Contains(err.Error(), "missing port") {
        log.Fatalf("each calculated_remotes entry requires a port: %v", err)
    }
    return err
}

When it happens

Trigger: Calling newCalculatedRemotesListFromConfig with a calculated_remotes map entry that omits the 'port' key entirely (rawMap["port"] is nil), e.g. only mask is provided.

Common situations: Users writing a calculated_remotes block assuming the port inherits from the lhouse/listen port, or copy-pasting partial example configs that omit the required port field.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• invalid mask: %s
• invalid port: %s: %w
• invalid port (type %T): %v
• no outside connection
• no inside interface (tun)

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/9506333190167a83. Report an issue: GitHub.