Blocked host '{host}' resolved to {v6}, which the configured

Error message

Blocked host '{host}' resolved to {v6}, which the configured NAT64 prefix {prefix} translates to non-global address {embedded}

What it means

Error "Blocked host '{host}' resolved to {v6}, which the configured NAT64 prefix {prefix} translates to non-global address {embedded}" thrown in zeroclaw-labs/zeroclaw.

Source

Thrown at crates/zeroclaw-infra/src/net_guard.rs:859

    if ips.is_empty() {
        anyhow::bail!("Failed to resolve host '{host}'");
    }

    for ip in ips {
        if is_cloud_metadata_ip(*ip) {
            return Err(metadata_block_error(host, *ip));
        }

        if let std::net::IpAddr::V6(v6) = ip {
            // Overlapping prefixes translate one address to several different
            // destinations. Every one of them is reachable, so the address is
            // accepted only when all of them are acceptable.
            for (prefix, embedded) in network_specific_embedded_ipv4s(*v6, nat64_prefixes) {
                if is_cloud_metadata_ip(std::net::IpAddr::V4(embedded)) {
                    return Err(nat64_metadata_block_error(host, *v6, prefix, embedded));
                }
                if is_non_global_v4(embedded) {
                    anyhow::bail!(
                        "Blocked host '{host}' resolved to {v6}, which the configured NAT64 prefix \
                         {prefix} translates to non-global address {embedded}"
                    );
                }
            }
        }

        let non_global = match ip {
            std::net::IpAddr::V4(v4) => is_non_global_v4(*v4),
            std::net::IpAddr::V6(v6) => is_non_global_v6(*v6),
        };
        if non_global {
            anyhow::bail!("Blocked host '{host}' resolved to non-global address {ip}");
        }
    }

    Ok(())
}

View on GitHub (pinned to 88bb9c8533)

Solutions

Remove the host from the allowlist or add the NAT64-translated non-global address range to allowed private hosts; do not bypass the guard silently.

When it happens

Trigger: Thrown at crates/zeroclaw-infra/src/net_guard.rs:859 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of zeroclaw-labs/zeroclaw@88bb9c8533 (2026-08-23). Data as JSON: /api/errors/743366bbbce07a0e. Report an issue: GitHub.