{"record":{"id":"665151e770a76908","repo":"grafana/k6","slug":"ip-s-is-in-a-blacklisted-range-q","errorCode":null,"errorMessage":"IP %s is in a blacklisted range %q","messagePattern":"IP (.+?) is in a blacklisted range %q","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/js/modules/k6/browser/common/network_manager.go","lineNumber":739,"sourceCode":"\tfailErr = checkBlockedIPs(ip, state.Options.BlacklistIPs)\n}\n\nfunc checkBlockedHosts(host string, blockedHosts *k6types.HostnameTrie) error {\n\tif blockedHosts == nil {\n\t\treturn nil\n\t}\n\tif match, blocked := blockedHosts.Contains(host); blocked {\n\t\treturn fmt.Errorf(\"hostname %s matches a blocked pattern %q\", host, match)\n\t}\n\treturn nil\n}\n\nfunc checkBlockedIPs(ip net.IP, blockedIPs []*k6lib.IPNet) error {\n\tfor _, ipnet := range blockedIPs {\n\t\tif ipnet.Contains(ip) {\n\t\t\t// TODO: Return netext.BlackListedIPError here once its private\n\t\t\t// fields are exported, or there's a constructor for it.\n\t\t\treturn fmt.Errorf(\"IP %s is in a blacklisted range %q\", ip, ipnet)\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc (m *NetworkManager) onAuthRequired(event *fetch.EventAuthRequired) {\n\tvar (\n\t\tres = fetch.AuthChallengeResponseResponseDefault\n\t\trid = event.RequestID\n\n\t\tusername, password string\n\t)\n\n\tswitch {\n\tcase m.attemptedAuth[rid]:\n\t\tdelete(m.attemptedAuth, rid)\n\t\tres = fetch.AuthChallengeResponseResponseCancelAuth\n\tcase !m.credentials.IsEmpty():","sourceCodeStart":721,"sourceCodeEnd":757,"githubUrl":"https://github.com/grafana/k6/blob/93accf6570dcd306ca5e99cc44c393ee3797761b/internal/js/modules/k6/browser/common/network_manager.go#L721-L757","documentation":"The browser module resolved the target host to an IP address and that IP falls inside one of the CIDR ranges configured in the k6 'blacklist_ips' option (state.Options.BlacklistIPs). checkBlockedIPs in the browser NetworkManager enforces the same blacklist k6 applies to HTTP requests, so the navigation/request is failed before it proceeds.","triggerScenarios":"Running with options like --blacklist-ips '10.0.0.0/8' or export let options = { blacklist_ips: ['...'] } and then calling page.goto()/click()/waitForNavigation() (or any in-page fetch) to a host whose DNS resolution lands inside a blacklisted CIDR. Both the initial navigation check and per-request checks (network_manager.go:706,721) run this test.","commonSituations":"Corporate scripts reuse HTTP-level options (blacklist_ips) that were added for API tests and accidentally cover IPs the browser test navigates to; a site redirect chain or CDN resolves to a blacklisted range; DNS in the test environment resolves a public name to an internal (e.g. 10.x) address.","solutions":["Check the error text for the exact IP and range, then either remove that CIDR from blacklist_ips or point the test at a host/IP outside it","If the destination is legitimately allowed, replace the broad CIDR with narrower ranges that exclude it","If the block is intentional, guard the navigation in the script or expect the page.goto() to fail","Verify with k6 inspect or a print of script options which blacklist_ips are actually in effect (options can be merged from multiple sources)"],"exampleFix":"// before\nexport const options = { blacklist_ips: ['0.0.0.0/0'] }; // blocks everything\n...await page.goto('https://test.k6.io/');\n\n// after\nexport const options = { blacklist_ips: ['10.0.0.0/8'] }; // only internal ranges\n...await page.goto('https://test.k6.io/');","handlingStrategy":"validation","validationCode":"// Before goto(), verify the resolved host is not in the blacklisted ranges\nimport { parse } from 'https://jslib.k6.io/k6-utils/1.0.0/index.js';\nconst blacklist = JSON.parse(__ENV.MY_BLACKLIST_IPS || '[]'); // e.g. ['10.0.0.0/8']\n// k6 itself resolves DNS; simplest guard: only blacklist what you must\nexport const options = { blacklist_ips: blacklist };","typeGuard":null,"tryCatchPattern":"try {\n  await page.goto(url);\n} catch (e) {\n  if (/IP .* is in a blacklisted range/.test(String(e))) {\n    console.warn(`skipping ${url}: IP blacklisted by options.blacklist_ips`);\n    return;\n  }\n  throw e;\n}","preventionTips":["Scope blacklist_ips to the exact internal ranges your test must avoid — never reuse broad HTTP-test options blindly in browser tests","Keep a list of blacklisted CIDRs next to the URLs under test so mismatches are caught in review","Run k6 inspect on the final options to see merged blacklist_ips before executing"],"tags":["network","browser","blacklist-ips","options","dns"],"backgroundTag":null,"analyzedSha":"93accf6570dcd306ca5e99cc44c393ee3797761b","analyzedAt":"2026-08-15T21:23:27.118Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}