{"record":{"id":"b5d47d4e5f0cc9a8","repo":"cloudflare/cloudflared","slug":"connect-to-v-denied","errorCode":null,"errorMessage":"Connect to %v denied","messagePattern":"Connect to (.+?) denied","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"socks/request_handler.go","lineNumber":68,"sourceCode":"\n// handleConnect is used to handle a connect command\nfunc (h *StandardRequestHandler) handleConnect(conn io.ReadWriter, req *Request) error {\n\tif h.accessPolicy != nil {\n\t\tif req.DestAddr.IP == nil {\n\t\t\taddr, err := net.ResolveIPAddr(\"ip\", req.DestAddr.FQDN)\n\t\t\tif err != nil {\n\t\t\t\t_ = sendReply(conn, ruleFailure, req.DestAddr)\n\t\t\t\treturn fmt.Errorf(\"unable to resolve host to confirm access\")\n\t\t\t}\n\n\t\t\treq.DestAddr.IP = addr.IP\n\t\t}\n\t\tif allowed, rule := h.accessPolicy.Allowed(req.DestAddr.IP, req.DestAddr.Port); !allowed {\n\t\t\t_ = sendReply(conn, ruleFailure, req.DestAddr)\n\t\t\tif rule != nil {\n\t\t\t\treturn fmt.Errorf(\"Connect to %v denied due to iprule: %s\", req.DestAddr, rule.String())\n\t\t\t}\n\t\t\treturn fmt.Errorf(\"Connect to %v denied\", req.DestAddr)\n\t\t}\n\t}\n\n\ttarget, localAddr, err := h.dialer.Dial(req.DestAddr.Address())\n\tif err != nil {\n\t\tmsg := err.Error()\n\t\tresp := hostUnreachable\n\t\tif strings.Contains(msg, \"refused\") {\n\t\t\tresp = connectionRefused\n\t\t} else if strings.Contains(msg, \"network is unreachable\") {\n\t\t\tresp = networkUnreachable\n\t\t}\n\t\tif err := sendReply(conn, resp, nil); err != nil {\n\t\t\treturn fmt.Errorf(\"Failed to send reply: %v\", err)\n\t\t}\n\t\treturn fmt.Errorf(\"Connect to %v failed: %v\", req.DestAddr, err)\n\t}\n\tdefer target.Close()","sourceCodeStart":50,"sourceCodeEnd":86,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/socks/request_handler.go#L50-L86","documentation":"The fallback branch of the access-policy denial in handleConnect: the policy rejected the destination but returned no specific rule object, so the handler returns a generic 'Connect to <dest> denied' error after sending a ruleFailure reply. Like error 316, this is an intentional rejection by the configured access policy.","triggerScenarios":"handleConnect with a non-nil accessPolicy where accessPolicy.Allowed(...) returns (false, nil) — typically a default-deny policy with no matching rule.","commonSituations":"Default-deny iprule sets where the destination matched no explicit rule; clients connecting to hosts nobody thought to allowlist; newly provisioned services not yet added to policy.","solutions":["Add an explicit allow rule for the destination IP/port to the access policy","Confirm with policy owners whether the destination should be reachable","If you need the specific rule name in errors, configure rules so a matching deny rule reports itself (see error 316 path)","Log destination addresses of denials to build the allowlist iteratively"],"exampleFix":"// before: default-deny, no allow rule\npolicy := iprules.NewDefault() // denies everything unmatched\n\n// after\npolicy.AddRule(true, \"10.0.0.0/24\", 0, 65535) // allow internal range","handlingStrategy":"validation","validationCode":"// pre-check against the same policy the server uses\nif ok, rule := accessPolicy.Allowed(destIP, destPort); !ok {\n    return fmt.Errorf(\"destination not allowlisted (rule=%v)\", rule)\n}","typeGuard":"func isAllowlisted(ip net.IP, port uint16) bool {\n    allowed, _ := accessPolicy.Allowed(ip, port)\n    return allowed\n}","tryCatchPattern":"if err := connect(dest); err != nil && err.Error() == fmt.Sprintf(\"Connect to %v denied\", dest) {\n    // default-deny hit: add an explicit allow rule\n}","preventionTips":["Avoid implicit default-deny surprises: document which destinations are allowlisted","Add explicit allow rules for every destination your applications need","Track denial logs to discover missing allowlist entries early"],"tags":["network","socks5","access-policy","acl"],"backgroundTag":"permission-denied","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}