slackhq/nebula · critical

no outside connection

Error message

no outside connection

What it means

NewInterface (interface.go) validates the InterfaceConfig before building the nebula interface. This error means c.Outside is nil — no UDP socket/connection for encrypted outbound traffic was supplied, so the interface cannot be constructed.

Source

Thrown at interface.go:186

	}
}

func (s recvErrorConfig) String() string {
	switch s {
	case recvErrorAlways:
		return "always"
	case recvErrorNever:
		return "never"
	case recvErrorPrivate:
		return "private"
	default:
		return fmt.Sprintf("invalid(%d)", s)
	}
}

func NewInterface(ctx context.Context, c *InterfaceConfig) (*Interface, error) {
	if c.Outside == nil {
		return nil, errors.New("no outside connection")
	}
	if c.Inside == nil {
		return nil, errors.New("no inside interface (tun)")
	}
	if c.pki == nil {
		return nil, errors.New("no certificate state")
	}
	if c.Firewall == nil {
		return nil, errors.New("no firewall rules")
	}
	if c.connectionManager == nil {
		return nil, errors.New("no connection manager")
	}

	if c.routines <= 1 {
		c.PinThreads = false //pinning is not useful unless there's more than one tun reader
	}

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Fix the underlying UDP bind failure (check port availability, host/port config, CAP_NET_ADMIN/net_bind capability)
2. Check earlier logs for the udp listener creation error before this one
3. Ensure Main/service wiring always sets InterfaceConfig.Outside from a successfully opened udp.Conn

if cfg.InterfaceConfig.Outside == nil {
    return errors.New("outside udp connection not initialized; check listen host/port and bind errors")
}

i, err := NewInterface(ctx, c)
if err != nil {
    if err.Error() == "no outside connection" { /* fix udp bind / listen config */ }
    return err
}

When it happens

Trigger: Calling NewInterface with an InterfaceConfig whose Outside field is nil, i.e. the udp.Conn for the outside (physical) interface was never created or failed to bind.

Common situations: UDP listener failed to bind (port in use, missing capability) earlier in Main and the nil conn was still passed through; misconfigured listen host/port in config; wiring bug in custom embedding of nebula.

Understand the failure class

Background: "X is required", "must be set", "cannot be empty": the missing-required-config error family, from Vertex AI project/location to WeChat keys — this error's family across 18 libraries.

Related errors

• no inside interface (tun)
• no certificate state
• no firewall rules
• no connection manager
• ErrInvalidIPv6RemoteForSocket

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/7d7be8ebc4cf010e. Report an issue: GitHub.