slackhq/nebula · critical

no firewall rules

Error message

no firewall rules

What it means

Configuration guard in NewInterface: InterfaceConfig.Firewall is nil — no firewall instance was supplied. Nebula refuses to start without a firewall because the default-deny security model requires one.

Source

Thrown at interface.go:195

	case recvErrorPrivate:
		return "private"
	default:
		return fmt.Sprintf("invalid(%d)", s)
	}
}

func NewInterface(ctx context.Context, c *InterfaceConfig) (*Interface, error) {
	if c.Outside == nil {
		return nil, errors.New("no outside connection")
	}
	if c.Inside == nil {
		return nil, errors.New("no inside interface (tun)")
	}
	if c.pki == nil {
		return nil, errors.New("no certificate state")
	}
	if c.Firewall == nil {
		return nil, errors.New("no firewall rules")
	}
	if c.connectionManager == nil {
		return nil, errors.New("no connection manager")
	}

	if c.routines <= 1 {
		c.PinThreads = false //pinning is not useful unless there's more than one tun reader
	}

	cs := c.pki.getCertState()
	ifce := &Interface{
		ctx:                   ctx,
		pki:                   c.pki,
		hostMap:               c.HostMap,
		outside:               c.Outside,
		inside:                c.Inside,
		firewall:              c.Firewall,
		dnsServer:             c.DnsServer,

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Check earlier logs for firewall rule compilation errors and fix the offending rule
2. Ensure the firewall section exists in config with at least an outbound/default rule set
3. Verify config schema (groups, cidr, port fields) matches nebula's expected format

if cfg.InterfaceConfig.Firewall == nil {
    return errors.New("firewall rules not compiled; check firewall config section")
}

i, err := NewInterface(ctx, c)
if err != nil {
    if err.Error() == "no firewall rules" { /* fix firewall config errors reported earlier in logs */ }
    return err
}

When it happens

Trigger: InterfaceConfig.Firewall is nil because firewall rules compilation failed or was omitted when building the config in Main.

Common situations: Invalid firewall rules in config causing NewFirewall to fail upstream; firewall section missing entirely; custom embedding not populating the field.

Understand the failure class

Background: "X is required", "must be set", "cannot be empty": the missing-required-config error family, from Vertex AI project/location to WeChat keys — this error's family across 18 libraries.

Related errors

• no outside connection
• no inside interface (tun)
• no certificate state
• no connection manager
• ErrPeerRejected

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/8fad608f9da57fdc. Report an issue: GitHub.