{"record":{"id":"7cce5052371a75c3","repo":"syncthing/syncthing","slug":"network-disallowed","errorCode":null,"errorMessage":"network disallowed","messagePattern":"network disallowed","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"lib/connections/service.go","lineNumber":664,"sourceCode":"\t\tif !initial && nextDialAt.get(deviceID, addr).After(now) {\n\t\t\tl.Debugf(\"Not dialing %s via %v as it's not time yet\", deviceID.Short(), addr)\n\t\t\tcontinue\n\t\t}\n\n\t\t// If we fail at any step before actually getting the dialer\n\t\t// retry in a minute\n\t\tnextDialAt.set(deviceID, addr, now.Add(time.Minute))\n\n\t\turi, err := url.Parse(addr)\n\t\tif err != nil {\n\t\t\ts.setConnectionStatus(addr, err)\n\t\t\tslog.WarnContext(ctx, \"Failed to parse dialer address\", slogutil.Address(addr), slogutil.Error(err))\n\t\t\tcontinue\n\t\t}\n\n\t\tif len(deviceCfg.AllowedNetworks) > 0 {\n\t\t\tif !IsAllowedNetwork(uri.Host, deviceCfg.AllowedNetworks) {\n\t\t\t\ts.setConnectionStatus(addr, errors.New(\"network disallowed\"))\n\t\t\t\tl.Debugln(\"Network for\", uri, \"is disallowed\")\n\t\t\t\tcontinue\n\t\t\t}\n\t\t}\n\n\t\tdialerFactory, err := getDialerFactory(cfg, uri)\n\t\tif err != nil {\n\t\t\ts.setConnectionStatus(addr, err)\n\t\t}\n\t\tif errors.Is(err, errUnsupported) {\n\t\t\tl.Debugf(\"Dialer for %v: %v\", uri, err)\n\t\t\tcontinue\n\t\t} else if err != nil {\n\t\t\tslog.WarnContext(ctx, \"Failed to get dialer\", slogutil.URI(uri), slogutil.Error(err))\n\t\t\tcontinue\n\t\t}\n\n\t\tdialer := dialerFactory.New(s.cfg.Options(), s.tlsCfg, s.registry, s.lanChecker)","sourceCodeStart":646,"sourceCodeEnd":682,"githubUrl":"https://github.com/syncthing/syncthing/blob/058bcd7334839663cf569501d3ac539034d45cb5/lib/connections/service.go#L646-L682","documentation":"Raised inline in the dial loop of the connection service: before dialing an address, if the device configuration has AllowedNetworks set, the address's host is checked with IsAllowedNetwork; failing addresses get their status set to errors.New(\"network disallowed\") and are skipped for this round (with next-dial backoff). It is the outbound counterpart of the errNetworkNotAllowed rejection and purely configuration-driven.","triggerScenarios":"deviceCfg.AllowedNetworks is non-empty and uri.Host of a candidate address (from discovery or config) does not match any allowed network, so the dialer records 'network disallowed' status and continues to the next address.","commonSituations":"Restricting a device to LAN ranges while global discovery returns public/relayed addresses, which are then skipped; leftover AllowedNetworks entries after subnet changes so all addresses get skipped and the device never connects.","solutions":["Update AllowedNetworks for the device to include the network of the addresses you want dialed (CIDR or glob syntax).","If no restriction is intended, empty the AllowedNetworks list.","Check /rest/system/connections address statuses to see which addresses are being marked 'network disallowed'.","When both direct and relay paths are needed, ensure the allowed networks cover relay addresses or disable the restriction."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Before presenting addresses to the dialer, filter by ACL:\nif len(deviceCfg.AllowedNetworks) > 0 {\n    host := addrHost(uri)\n    if !connections.IsAllowedNetwork(host, deviceCfg.AllowedNetworks) {\n        continue // skip disallowed address up front\n    }\n}","typeGuard":null,"tryCatchPattern":"// status is recorded per address; inspect it rather than catching:\nif status := connStatus[addr]; strings.Contains(status, \"network disallowed\") {\n    // adjust AllowedNetworks or drop the address source\n}","preventionTips":["Keep AllowedNetworks aligned with the subnets your discovery sources return.","Inspect /rest/system/connections to catch silently skipped addresses.","Remember an empty AllowedNetworks disables the filter entirely."],"tags":["network","acl","dialing","config","syncthing"],"backgroundTag":null,"analyzedSha":"058bcd7334839663cf569501d3ac539034d45cb5","analyzedAt":"2026-08-15T07:53:43.174Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}