grafana/k6 · error

IP %s is in a blacklisted range %q

Error message

IP %s is in a blacklisted range %q

What it means

The browser module resolved the target host to an IP address and that IP falls inside one of the CIDR ranges configured in the k6 'blacklist_ips' option (state.Options.BlacklistIPs). checkBlockedIPs in the browser NetworkManager enforces the same blacklist k6 applies to HTTP requests, so the navigation/request is failed before it proceeds.

Source

Thrown at internal/js/modules/k6/browser/common/network_manager.go:739

	failErr = checkBlockedIPs(ip, state.Options.BlacklistIPs)
}

func checkBlockedHosts(host string, blockedHosts *k6types.HostnameTrie) error {
	if blockedHosts == nil {
		return nil
	}
	if match, blocked := blockedHosts.Contains(host); blocked {
		return fmt.Errorf("hostname %s matches a blocked pattern %q", host, match)
	}
	return nil
}

func checkBlockedIPs(ip net.IP, blockedIPs []*k6lib.IPNet) error {
	for _, ipnet := range blockedIPs {
		if ipnet.Contains(ip) {
			// TODO: Return netext.BlackListedIPError here once its private
			// fields are exported, or there's a constructor for it.
			return fmt.Errorf("IP %s is in a blacklisted range %q", ip, ipnet)
		}
	}
	return nil
}

func (m *NetworkManager) onAuthRequired(event *fetch.EventAuthRequired) {
	var (
		res = fetch.AuthChallengeResponseResponseDefault
		rid = event.RequestID

		username, password string
	)

	switch {
	case m.attemptedAuth[rid]:
		delete(m.attemptedAuth, rid)
		res = fetch.AuthChallengeResponseResponseCancelAuth
	case !m.credentials.IsEmpty():

View on GitHub (pinned to 93accf6570)

Solutions

1. Check the error text for the exact IP and range, then either remove that CIDR from blacklist_ips or point the test at a host/IP outside it
2. If the destination is legitimately allowed, replace the broad CIDR with narrower ranges that exclude it
3. If the block is intentional, guard the navigation in the script or expect the page.goto() to fail
4. Verify with k6 inspect or a print of script options which blacklist_ips are actually in effect (options can be merged from multiple sources)

Example fix

// before
export const options = { blacklist_ips: ['0.0.0.0/0'] }; // blocks everything
...await page.goto('https://test.k6.io/');

// after
export const options = { blacklist_ips: ['10.0.0.0/8'] }; // only internal ranges
...await page.goto('https://test.k6.io/');

// Before goto(), verify the resolved host is not in the blacklisted ranges
import { parse } from 'https://jslib.k6.io/k6-utils/1.0.0/index.js';
const blacklist = JSON.parse(__ENV.MY_BLACKLIST_IPS || '[]'); // e.g. ['10.0.0.0/8']
// k6 itself resolves DNS; simplest guard: only blacklist what you must
export const options = { blacklist_ips: blacklist };

try {
  await page.goto(url);
} catch (e) {
  if (/IP .* is in a blacklisted range/.test(String(e))) {
    console.warn(`skipping ${url}: IP blacklisted by options.blacklist_ips`);
    return;
  }
  throw e;
}

When it happens

Trigger: Running with options like --blacklist-ips '10.0.0.0/8' or export let options = { blacklist_ips: ['...'] } and then calling page.goto()/click()/waitForNavigation() (or any in-page fetch) to a host whose DNS resolution lands inside a blacklisted CIDR. Both the initial navigation check and per-request checks (network_manager.go:706,721) run this test.

Common situations: Corporate scripts reuse HTTP-level options (blacklist_ips) that were added for API tests and accidentally cover IPs the browser test navigates to; a site redirect chain or CDN resolves to a blacklisted range; DNS in the test environment resolves a public name to an internal (e.g. 10.x) address.

Related errors

• newResolver(%+v): %w
• errorText
• missing presigned url in response body
• parsing get attribute options: %w
• parsing inner HTML options: %w

AI-assisted analysis of grafana/k6@93accf6570 (2026-08-15). Data as JSON: /api/errors/665151e770a76908. Report an issue: GitHub.