What causes "%sout of range [0,65535]; `%s`" in slackhq/nebula?

Fix the port value in the Nebula config YAML so it is an integer in [0,65535]

%sout of range [0,65535]; `%s`

Error message

%sout of range [0,65535]; `%s`

What it means

Nebula's firewall rule parser calls parsePortValue to convert a port string from the config into an int32. When strconv.ParseUint(s,10,16) fails with strconv.ErrRange (the text is numeric but outside the uint16 port range), it returns this error wrapping the prefix and the offending string. Valid ports must be 0-65535.

Source

Thrown at firewall.go:1115

}

// parsePortValue accepts a base-10 decimal in [0, 65535] and returns it
// widened to int32. Using strconv.ParseUint with bitSize 16 rejects
// negative input, out-of-range input (>65535), and any non-decimal byte
// by construction, so the int32 widening that follows is provably safe
// and cannot collide with firewall.PortAny (0) or firewall.PortFragment
// (-1) via integer truncation.
//
// prefix is prepended to both error messages so callers can disambiguate
// the single-port path (prefix="") from the range bounds (prefix="beginning
// range " / "ending range "), preserving the historical error strings.
func parsePortValue(prefix, s string) (int32, error) {
	n, err := strconv.ParseUint(s, 10, 16)
	if err == nil {
		return int32(n), nil
	}
	if errors.Is(err, strconv.ErrRange) {
		return 0, fmt.Errorf("%sout of range [0,65535]; `%s`", prefix, s)
	}
	return 0, fmt.Errorf("%swas not a number; `%s`", prefix, s)
}

View on GitHub (pinned to dd8f660c0a)

Solutions

Fix the port value in the Nebula config YAML so it is an integer in [0,65535]
If a port range is intended, use the 'port: start-end' range syntax with both endpoints in range
Re-run `nebula -config ...` / `-test` to validate the config before deploying

Example fix

// before
firewall:
  inbound:
    - port: 70000
      proto: tcp
// after
firewall:
  inbound:
    - port: 443
      proto: tcp

Defensive patterns

Strategy: validation

Validate before calling

func validPort(s string) bool {
	n, err := strconv.ParseUint(strings.TrimSpace(s), 10, 16)
	return err == nil && n >= 0 && n <= 65535
}
// call before writing the port into the nebula config

Prevention

Always emit ports as integers within 0-65535 when generating nebula configs
Use `nebula -test -config` in CI to catch bad firewall rules before deploy
Prefer range syntax 'start-end' over manual arithmetic that can overflow
Lint YAML configs for port fields with a JSON/YAML schema limiting port to 0-65535

When it happens

Trigger: A firewall rule in the Nebula config (e.g. firewall.outbound / inbound port fields) contains a numeric string outside [0,65535], such as '70000' or a value with trailing whitespace making it overflow the 16-bit parse, passed via parsePort (firewall.go:1067) or addFireWallRulesFromConfig.

Common situations: Typos in firewall rules (port 65536+), copy-paste of 0-based or decimal-expanded port values, generated rules from scripts using wrong ranges, YAML values parsed as strings like '99999'.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/95e51238090fbbe3. Report an issue: GitHub.