Tencent/WeKnora · error

connection blocked: %s resolves to restricted IP %s

Error message

connection blocked: %s resolves to restricted IP %s

What it means

Fired in pinnedDialContext when a resolved IP of the target host falls in a restricted range (private, loopback, link-local, etc.). This is the SSRF guard: the fetcher deliberately blocks connections to internal network addresses reached via a public hostname (DNS rebinding protection).

Source

Thrown at internal/infrastructure/web_fetch/fetcher.go:242

func (f *Fetcher) pinnedDialContext() func(context.Context, string, string) (net.Conn, error) {
	return func(ctx context.Context, network, address string) (net.Conn, error) {
		host, port, err := net.SplitHostPort(address)
		if err != nil {
			return nil, fmt.Errorf("invalid address %s: %w", address, err)
		}
		if utils.IsSystemProxy(address) || utils.IsSSRFWhitelisted(host) {
			return (&net.Dialer{Timeout: 30 * time.Second, KeepAlive: 30 * time.Second}).DialContext(ctx, network, address)
		}
		ips, err := f.resolveIPs(ctx, host)
		if err != nil {
			return nil, fmt.Errorf("DNS resolution failed for %s: %w", host, err)
		}
		if len(ips) == 0 {
			return nil, fmt.Errorf("DNS resolution failed: no addresses for %s", host)
		}
		for _, ip := range ips {
			if !utils.IsPublicIP(ip) {
				return nil, fmt.Errorf("connection blocked: %s resolves to restricted IP %s", host, ip)
			}
		}
		pinnedAddress := net.JoinHostPort(ips[0].String(), port)
		if f.dialContext != nil {
			return f.dialContext(ctx, network, pinnedAddress)
		}
		return (&net.Dialer{Timeout: 30 * time.Second, KeepAlive: 30 * time.Second}).DialContext(ctx, network, pinnedAddress)
	}
}

func (f *Fetcher) fetchWithBrowser(ctx context.Context, rawURL string) (string, error) {
	target, err := f.resolvePinnedTarget(ctx, rawURL)
	if err != nil {
		return "", err
	}
	return f.renderBrowser(ctx, target)
}

View on GitHub (pinned to 988cbb0330)

Solutions

1. Confirm the URL points to a genuinely public host
2. If the host is intentionally internal, add it to the SSRF whitelist rather than disabling the guard
3. Do not bypass this check for user-supplied URLs

When it happens

Trigger: Thrown at internal/infrastructure/web_fetch/fetcher.go:242 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/2b07d45579e24fb5. Report an issue: GitHub.