{"record":{"id":"3968ee8737bd8075","repo":"cloudflare/cloudflared","slug":"connect-to-v-denied-due-to-iprule-s","errorCode":null,"errorMessage":"Connect to %v denied due to iprule: %s","messagePattern":"Connect to (.+?) denied due to iprule: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"socks/request_handler.go","lineNumber":66,"sourceCode":"\t}\n}\n\n// handleConnect is used to handle a connect command\nfunc (h *StandardRequestHandler) handleConnect(conn io.ReadWriter, req *Request) error {\n\tif h.accessPolicy != nil {\n\t\tif req.DestAddr.IP == nil {\n\t\t\taddr, err := net.ResolveIPAddr(\"ip\", req.DestAddr.FQDN)\n\t\t\tif err != nil {\n\t\t\t\t_ = sendReply(conn, ruleFailure, req.DestAddr)\n\t\t\t\treturn fmt.Errorf(\"unable to resolve host to confirm access\")\n\t\t\t}\n\n\t\t\treq.DestAddr.IP = addr.IP\n\t\t}\n\t\tif allowed, rule := h.accessPolicy.Allowed(req.DestAddr.IP, req.DestAddr.Port); !allowed {\n\t\t\t_ = sendReply(conn, ruleFailure, req.DestAddr)\n\t\t\tif rule != nil {\n\t\t\t\treturn fmt.Errorf(\"Connect to %v denied due to iprule: %s\", req.DestAddr, rule.String())\n\t\t\t}\n\t\t\treturn fmt.Errorf(\"Connect to %v denied\", req.DestAddr)\n\t\t}\n\t}\n\n\ttarget, localAddr, err := h.dialer.Dial(req.DestAddr.Address())\n\tif err != nil {\n\t\tmsg := err.Error()\n\t\tresp := hostUnreachable\n\t\tif strings.Contains(msg, \"refused\") {\n\t\t\tresp = connectionRefused\n\t\t} else if strings.Contains(msg, \"network is unreachable\") {\n\t\t\tresp = networkUnreachable\n\t\t}\n\t\tif err := sendReply(conn, resp, nil); err != nil {\n\t\t\treturn fmt.Errorf(\"Failed to send reply: %v\", err)\n\t\t}\n\t\treturn fmt.Errorf(\"Connect to %v failed: %v\", req.DestAddr, err)","sourceCodeStart":48,"sourceCodeEnd":84,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/socks/request_handler.go#L48-L84","documentation":"When an access policy is configured and its Allowed(ip, port) check rejects the connection with a matching rule, handleConnect sends a ruleFailure reply and returns this error naming the denied destination and the rule's string representation. This is an intentional policy denial, not a malfunction.","triggerScenarios":"handleConnect with a non-nil accessPolicy where accessPolicy.Allowed(req.DestAddr.IP, req.DestAddr.Port) returns (false, non-nil rule).","commonSituations":"Legitimate destinations blocked by an overly broad deny rule; clients requesting hosts outside the allowlist (default-deny policies); rule misconfiguration after network changes; corporate policy blocking the target port.","solutions":["Review the rule in the error message and adjust the iprule allowlist to include the destination","Confirm the client is connecting to an intended host/port within policy","Temporarily enable policy logging to see which requests hit which rules","If the policy should permit it, update rule definitions passed to the handler's access policy"],"exampleFix":"// before: default-deny blocks 10.0.0.5\npolicy := iprules.NewDefault()\n\n// after: add allow rule\npolicy.AddRule(true, \"10.0.0.0/24\", 0, 65535)","handlingStrategy":"validation","validationCode":"// client side: check the destination against policy before requesting\nif !policyAllows(destIP, destPort) {\n    return fmt.Errorf(\"destination %s:%d will be denied by policy\", destIP, destPort)\n}","typeGuard":"func policyAllows(ip net.IP, port uint16) bool {\n    ok, _ := accessPolicy.Allowed(ip, port)\n    return ok\n}","tryCatchPattern":"if err := connect(dest); err != nil && strings.Contains(err.Error(), \"denied due to iprule\") {\n    // surface rule name to the user; do not retry\n}","preventionTips":["Keep the iprule allowlist in sync with the set of destinations your apps use","Log every denial with rule name during policy rollouts","Review rules after network topology changes"],"tags":["network","socks5","access-policy","acl"],"backgroundTag":"permission-denied","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}