zeroclaw-labs/zeroclaw · error

Blocked host '{host}' resolved to non-global address {ip}

Error message

Blocked host '{host}' resolved to non-global address {ip}

What it means

Error "Blocked host '{host}' resolved to non-global address {ip}" thrown in zeroclaw-labs/zeroclaw.

Source

Thrown at crates/zeroclaw-infra/src/net_guard.rs:872

            for (prefix, embedded) in network_specific_embedded_ipv4s(*v6, nat64_prefixes) {
                if is_cloud_metadata_ip(std::net::IpAddr::V4(embedded)) {
                    return Err(nat64_metadata_block_error(host, *v6, prefix, embedded));
                }
                if is_non_global_v4(embedded) {
                    anyhow::bail!(
                        "Blocked host '{host}' resolved to {v6}, which the configured NAT64 prefix \
                         {prefix} translates to non-global address {embedded}"
                    );
                }
            }
        }

        let non_global = match ip {
            std::net::IpAddr::V4(v4) => is_non_global_v4(*v4),
            std::net::IpAddr::V6(v6) => is_non_global_v6(*v6),
        };
        if non_global {
            anyhow::bail!("Blocked host '{host}' resolved to non-global address {ip}");
        }
    }

    Ok(())
}

/// Reject a resolution that contains a known metadata address, but permit
/// other private and loopback addresses. For callers that carry an explicit
/// operator opt-in for private destinations; the known metadata endpoints
/// remain blocked regardless.
///
/// The private opt-in never extends to metadata addresses, so an IPv6 answer
/// inside one of `nat64_prefixes` is rejected when the IPv4 address it embeds
/// is a metadata address. Overlapping prefixes decode one answer to several
/// destinations; the answer is rejected when any of them is a metadata
/// address.
///
/// # DNS pinning

View on GitHub (pinned to 88bb9c8533)

Solutions

1. The host resolves to a non-global address; allow it explicitly via allowed_private_hosts only if intended, or remove it.

When it happens

Trigger: Thrown at crates/zeroclaw-infra/src/net_guard.rs:872 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of zeroclaw-labs/zeroclaw@88bb9c8533 (2026-08-23). Data as JSON: /api/errors/fdd790239bbc20f9. Report an issue: GitHub.