Skip to main content

NFT051 - Prefix Overlaps an Existing Entry

Agent error code #NFT051 indicates that the address could not be added because it overlaps an entry already in the set. An nftables set declared with flags interval stores ranges and rejects an element that overlaps one it already holds, rather than merging them.

Re-granting an address the set already holds is not an error and does not produce this code. The agent settles that case against the kernel first: it re-adds the element, and only reports an overlap once it has confirmed that the element in the way is a different one, for example an existing 10.0.0.0/8 blocking 10.1.2.3.

Only interval sets can report this. A set without flags interval stores one address per element and has no overlap rule, though it also cannot hold a prefix at all.

Common causes include:

  • A broad prefix was added to the set by hand or by another tool, and it covers the address being granted
  • A predefined source network on a knoc overlaps a user's address
  • Two knocs write to the same set with prefixes that cover each other

Steps to Resolve

Find the Overlapping Entry

  1. Print the set contents: sudo nft list set <family> <table> <set>
  2. Look for an entry whose range contains the address from the failed grant

Remove or Narrow the Broad Entry

  1. If a wide prefix was added by hand, remove it:
sudo nft delete element <family> <table> <set> { 10.0.0.0/8 }
  1. If it has to stay, it already permits the access the knoc was trying to grant. Point the knoc at a different set rather than fighting over this one

Check the Knocs Sharing the Set

Two knocs pointed at one set share its contents. If one grants a network and the other grants single addresses inside it, the second fails every time. Give them separate sets, or narrow the network the first one grants.

Consider Whether the Set Should Be an Interval Set

If the overlaps are legitimate and the knoc only ever grants single addresses, a set without flags interval stores each address on its own and never reports this. It cannot hold prefixes, so predefined network sources need the interval form. Flags cannot be altered in place, so changing this means recreating the set, which empties it.

Back to top