slackhq/nebula · critical

no inside interface (tun)

Error message

no inside interface (tun)

What it means

Configuration guard in nebula.Main's NewInterface: the InterfaceConfig.Inside field (the tun device) is nil. NewInterface refuses to construct an Interface without an inside tunnel device since all packet flow depends on it.

Source

Thrown at interface.go:189

func (s recvErrorConfig) String() string {
	switch s {
	case recvErrorAlways:
		return "always"
	case recvErrorNever:
		return "never"
	case recvErrorPrivate:
		return "private"
	default:
		return fmt.Sprintf("invalid(%d)", s)
	}
}

func NewInterface(ctx context.Context, c *InterfaceConfig) (*Interface, error) {
	if c.Outside == nil {
		return nil, errors.New("no outside connection")
	}
	if c.Inside == nil {
		return nil, errors.New("no inside interface (tun)")
	}
	if c.pki == nil {
		return nil, errors.New("no certificate state")
	}
	if c.Firewall == nil {
		return nil, errors.New("no firewall rules")
	}
	if c.connectionManager == nil {
		return nil, errors.New("no connection manager")
	}

	if c.routines <= 1 {
		c.PinThreads = false //pinning is not useful unless there's more than one tun reader
	}

	cs := c.pki.getCertState()
	ifce := &Interface{
		ctx:                   ctx,

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Ensure the tun device is available (/dev/net/tun exists, kernel module loaded) and process has privileges
2. Check earlier logs for the tun creation error for the root cause
3. Fix tun section of config (dev name, mtu, routes)
4. Grant NET_ADMIN capability or run with required OS privileges

if cfg.InterfaceConfig.Inside == nil {
    return errors.New("tun device not created; check /dev/net/tun and privileges")
}

i, err := NewInterface(ctx, c)
if err != nil {
    if err.Error() == "no inside interface (tun)" { /* fix tun creation: privileges, device, config */ }
    return err
}

When it happens

Trigger: InterfaceConfig.Inside is nil because tun device creation failed or was skipped before NewInterface was called from Main.

Common situations: Missing /dev/net/tun or TUN module not loaded (Linux); missing admin privileges on Windows/macOS; invalid tun config (device name, routes); container without NET_ADMIN.

Understand the failure class

Background: "X is required", "must be set", "cannot be empty": the missing-required-config error family, from Vertex AI project/location to WeChat keys — this error's family across 18 libraries.

Related errors

• no outside connection
• no certificate state
• no firewall rules
• no connection manager
• error while setting up graphite sink: %s

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/28f3d05c4b673657. Report an issue: GitHub.