Skip to main content

NFT051 - Prefix Overlaps an Existing Entry

Agent error code #NFT051 indicates that the address could not be added because it overlaps an entry already in the set. An nftables interval set cannot hold overlapping elements, and the kernel rejects the addition rather than merging them.

Re-granting an address the set already holds is not an error and does not produce this code. This code means a different, overlapping element is in the way, for example an existing 10.0.0.0/8 blocking the addition of 10.1.2.3/32.

Common causes include:

  • A broad prefix was added to the set by hand or by another tool, and it covers the address being granted
  • A predefined source network on the knoc overlaps a user's address
  • Two knocs write to the same set with prefixes that cover each other

Steps to Resolve

Find the Overlapping Entry

  1. Print the set contents: sudo nft list set <family> <table> <set>
  2. Look for an entry whose range contains the address from the failed grant

Remove or Narrow the Broad Entry

  1. If a wide prefix was added manually, remove it: sudo nft delete element <family> <table> <set> { 10.0.0.0/8 }
  2. If it is needed permanently, it already grants the access the knoc was trying to give, so consider whether the knoc should target a different set

Consider the Set Type

An interval set (flags interval) stores ranges and rejects overlaps. A plain set stores single addresses and has no overlap rule but cannot hold prefixes at all. If the knoc needs to grant prefixes and the overlaps are legitimate, the set is the wrong shape for the job. Changing it means recreating the set, since flags cannot be altered in place.

Back to top