slackhq/nebula · error

unable to create AF_ROUTE socket: %v

Error message

unable to create AF_ROUTE socket: %v

What it means

addRoute opens a raw AF_ROUTE socket to send routing socket messages (RTM_ADD) to the kernel. If unix.Socket fails, the error is wrapped with this message. On OpenBSD this typically means the process lacks the privilege to open routing sockets.

Source

Thrown at overlay/tun_openbsd.go:427

			t.l.Error("Failed to remove route", "error", err, "route", r)
		} else {
			t.l.Info("Removed route", "route", r)
		}
	}
	return nil
}

func (t *tun) deviceBytes() (o [16]byte) {
	for i, c := range t.Device {
		o[i] = byte(c)
	}
	return
}

func addRoute(prefix netip.Prefix, gateways []netip.Prefix) error {
	sock, err := unix.Socket(unix.AF_ROUTE, unix.SOCK_RAW, unix.AF_UNSPEC)
	if err != nil {
		return fmt.Errorf("unable to create AF_ROUTE socket: %v", err)
	}
	defer unix.Close(sock)

	route := &netroute.RouteMessage{
		Version: unix.RTM_VERSION,
		Type:    unix.RTM_ADD,
		Flags:   unix.RTF_UP | unix.RTF_GATEWAY,
		Seq:     1,
	}

	if prefix.Addr().Is4() {
		gw, err := selectGateway(prefix, gateways)
		if err != nil {
			return err
		}
		route.Addrs = []netroute.Addr{
			unix.RTAX_DST:     &netroute.Inet4Addr{IP: prefix.Masked().Addr().As4()},
			unix.RTAX_NETMASK: &netroute.Inet4Addr{IP: prefixToMask(prefix).As4()},

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Run the process as root or grant routing privileges
2. If using OpenBSD pledge, include the 'route' promise
3. Check ulimit -n / fd exhaustion if EMFILE is the cause
4. Ensure the service unit/config grants the needed capability

Example fix

# before
$ ./nebula -config config.yaml  # unprivileged, AF_ROUTE denied
# after
$ doas ./nebula -config config.yaml

probe, err := unix.Socket(unix.AF_ROUTE, unix.SOCK_RAW, unix.AF_UNSPEC)
if err != nil {
    return fmt.Errorf("cannot open routing socket (need root/pledge route): %w", err)
}
unix.Close(probe)

if err := t.Activate(); err != nil {
    var errno syscall.Errno
    if errors.As(err, &errno) && (errno == syscall.EPERM || errno == syscall.EACCES) {
        log.Error("routing socket denied; run as root or add 'route' pledge")
    }
    return err
}

When it happens

Trigger: addIp or addRoutes invoking addRoute when socket(AF_ROUTE, SOCK_RAW, AF_UNSPEC) fails — unprivileged user, resource limits, or seccomp/pledge restrictions blocking socket creation.

Common situations: OpenBSD 'pledge' sandboxes without 'route' promise; running nebula as a non-root service; fd limits exhausted.

Related errors

• unable to create AF_ROUTE socket: %v
• failed to set route for vpn network %v: %w
• ErrInvalidIPv6RemoteForSocket
• INetwork.SetCategory: %s
• system socket: %v

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/f91b0dee21998f87. Report an issue: GitHub.