Skip to main content

NFT051 - Prefix Overlaps an Existing Entry

Agent error code #NFT051 indicates that the address could not be added because it overlaps an entry already in the set. An nftables interval set cannotdeclared holdwith overlappingflags elements,interval stores ranges and the kernel rejects thean additionelement that overlaps one it already holds, rather than merging them.

Re-granting an address the set already holds is not an error and does not produce this code. ThisThe codeagent meanssettles athat different,case overlappingagainst the kernel first: it re-adds the element, and only reports an overlap once it has confirmed that the element is in the way,way is a different one, for example an existing 10.0.0.0/8 blocking the addition of 10.1.2.3/323.

Only interval sets can report this. A set without flags interval stores one address per element and has no overlap rule, though it also cannot hold a prefix at all.

Common causes include:

  • A broad prefix was added to the set by hand or by another tool, and it covers the address being granted
  • A predefined source network on thea knoc overlaps a user's address
  • Two knocs write to the same set with prefixes that cover each other

Steps to Resolve

Find the Overlapping Entry

  1. Print the set contents: sudo nft list set <family> <table> <set>
  2. Look for an entry whose range contains the address from the failed grant

Remove or Narrow the Broad Entry

  1. If a wide prefix was added manually,by hand, remove it:
sudo nft delete element <family> <table> <set> { 10.0.0.0/8 }
  1. If it ishas neededto permanently,stay, it already grantspermits the access the knoc was trying to give,grant. so consider whetherPoint the knoc should targetat a different set rather than fighting over this one

Check the Knocs Sharing the Set

Two knocs pointed at one set share its contents. If one grants a network and the other grants single addresses inside it, the second fails every time. Give them separate sets, or narrow the network the first one grants.

Consider Whether the Set TypeShould Be an Interval Set

An interval set (flags interval) stores ranges and rejects overlaps. A plain set stores single addresses and has no overlap rule but cannot hold prefixes at all. If the knoc needs to grant prefixes and the overlaps are legitimate,legitimate and the knoc only ever grants single addresses, a set iswithout flags interval stores each address on its own and never reports this. It cannot hold prefixes, so predefined network sources need the wronginterval shapeform. forFlags thecannot job.be Changingaltered itin place, so changing this means recreating the set, sincewhich flagsempties cannot be altered in place.it.

Back to top