What causes "unable to find host" in slackhq/nebula?

Verify the relay host is connected and present in the hostmap (check nebula logs for the relay host's handshake)

unable to find host

Error message

unable to find host

What it means

HostMap.QueryRelayForByIpVpnAddr (hostmap.go) looks up the relay host by its IP in hm.Hosts and then queries that host's relay state for an established relay to the target. This error is returned when the given relayHostIp has no entry in the HostMap at all, so no relayed route can be resolved for the packet.

Source

Thrown at hostmap.go:598

	} else {
		hm.RUnlock()
		return nil
	}
}

func (hm *HostMap) QueryVpnAddr(vpnIp netip.Addr) *HostInfo {
	return hm.queryVpnAddr(vpnIp, nil)
}

func (hm *HostMap) QueryVpnAddrsRelayFor(targetIps []netip.Addr, relayHostIp netip.Addr) (*HostInfo, *Relay, error) {
	hm.RLock()
	defer hm.RUnlock()

	// This runs per relayed packet, so check the primary with a single map probe and only consult
	// moreHosts when the primary can't relay for us.
	h, ok := hm.Hosts[relayHostIp]
	if !ok {
		return nil, nil, errors.New("unable to find host")
	}

	for _, targetIp := range targetIps {
		r, ok := h.relayState.QueryRelayForByIp(targetIp)
		if ok && r.State == Established {
			return h, r, nil
		}
	}

	if list, ok := hm.moreHosts[relayHostIp]; ok {
		// list[0] is the primary we already checked
		for _, h := range list[1:] {
			for _, targetIp := range targetIps {
				r, ok := h.relayState.QueryRelayForByIp(targetIp)
				if ok && r.State == Established {
					return h, r, nil
				}
			}

View on GitHub (pinned to dd8f660c0a)

Solutions

Verify the relay host is connected and present in the hostmap (check nebula logs for the relay host's handshake)
Re-establish the tunnel/relay so the host entry is re-added
Check for host-entry expiry settings or aggressive pruning affecting the relay host
Ensure both peers run compatible nebula versions supporting relays

Defensive patterns

Strategy: validation

Validate before calling

// before relying on relays, confirm the relay host exists
hm.RLock()
_, ok := hm.Hosts[relayHostIp]
hm.RUnlock()
if !ok { /* re-handshake with relay host or fall back to direct path */ }

Try / catch

if _, _, err := hm.QueryRelayForByIpVpnAddr(relayHostIp, targetIps); err != nil && err.Error() == "unable to find host" { /* fall back to direct handshake */ }

Prevention

Monitor relay host liveness and prune relay state when the relay host expires
Re-handshake promptly when relay errors appear
Keep nebula versions consistent across relay and relayed hosts

When it happens

Trigger: A relayed packet arrives/is relayed with a relayHostIp that was never added to the HostMap, or the host entry was evicted/expired (dead host pruning) between relay establishment and this packet.

Common situations: Relay host disconnected or its host entry aged out while other peers still hold relay state pointing at it; misconfigured relay IP in relay setup; packet race during host teardown.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/90f5e8e7150ee719. Report an issue: GitHub.