syncthing/syncthing · warning

network disallowed

Error message

network disallowed

What it means

Raised inline in the dial loop of the connection service: before dialing an address, if the device configuration has AllowedNetworks set, the address's host is checked with IsAllowedNetwork; failing addresses get their status set to errors.New("network disallowed") and are skipped for this round (with next-dial backoff). It is the outbound counterpart of the errNetworkNotAllowed rejection and purely configuration-driven.

Source

Thrown at lib/connections/service.go:664

		if !initial && nextDialAt.get(deviceID, addr).After(now) {
			l.Debugf("Not dialing %s via %v as it's not time yet", deviceID.Short(), addr)
			continue
		}

		// If we fail at any step before actually getting the dialer
		// retry in a minute
		nextDialAt.set(deviceID, addr, now.Add(time.Minute))

		uri, err := url.Parse(addr)
		if err != nil {
			s.setConnectionStatus(addr, err)
			slog.WarnContext(ctx, "Failed to parse dialer address", slogutil.Address(addr), slogutil.Error(err))
			continue
		}

		if len(deviceCfg.AllowedNetworks) > 0 {
			if !IsAllowedNetwork(uri.Host, deviceCfg.AllowedNetworks) {
				s.setConnectionStatus(addr, errors.New("network disallowed"))
				l.Debugln("Network for", uri, "is disallowed")
				continue
			}
		}

		dialerFactory, err := getDialerFactory(cfg, uri)
		if err != nil {
			s.setConnectionStatus(addr, err)
		}
		if errors.Is(err, errUnsupported) {
			l.Debugf("Dialer for %v: %v", uri, err)
			continue
		} else if err != nil {
			slog.WarnContext(ctx, "Failed to get dialer", slogutil.URI(uri), slogutil.Error(err))
			continue
		}

		dialer := dialerFactory.New(s.cfg.Options(), s.tlsCfg, s.registry, s.lanChecker)

View on GitHub (pinned to 058bcd7334)

Solutions

1. Update AllowedNetworks for the device to include the network of the addresses you want dialed (CIDR or glob syntax).
2. If no restriction is intended, empty the AllowedNetworks list.
3. Check /rest/system/connections address statuses to see which addresses are being marked 'network disallowed'.
4. When both direct and relay paths are needed, ensure the allowed networks cover relay addresses or disable the restriction.

// Before presenting addresses to the dialer, filter by ACL:
if len(deviceCfg.AllowedNetworks) > 0 {
    host := addrHost(uri)
    if !connections.IsAllowedNetwork(host, deviceCfg.AllowedNetworks) {
        continue // skip disallowed address up front
    }
}

// status is recorded per address; inspect it rather than catching:
if status := connStatus[addr]; strings.Contains(status, "network disallowed") {
    // adjust AllowedNetworks or drop the address source
}

When it happens

Trigger: deviceCfg.AllowedNetworks is non-empty and uri.Host of a candidate address (from discovery or config) does not match any allowed network, so the dialer records 'network disallowed' status and continues to the next address.

Common situations: Restricting a device to LAN ranges while global discovery returns public/relayed addresses, which are then skipped; leftover AllowedNetworks entries after subnet changes so all addresses get skipped and the device never connects.

Related errors

• network not allowed
• unsupported protocol
• get default port (GUI): %w
• no suitable name
• no multicast interfaces available

AI-assisted analysis of syncthing/syncthing@058bcd7334 (2026-08-15). Data as JSON: /api/errors/7cce5052371a75c3. Report an issue: GitHub.