Issue Station
Sign In
Tools hereToolbox

openclaw - ✅(Solved) Fix [Bug] Telegram media download blocked - resolves to private IP [1 pull requests, 1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#65153•Fetched 2026-04-12 13:25:18
View on GitHub
Comments
1
Participants
2
Timeline
3
Reactions
0
Author
gzxmrengzxmren
Participants
draixdraixgzxmrengzxmren
Timeline (top)
commented ×1cross-referenced ×1referenced ×1

Fix Action

Fixed

PR fix notes

PR #65176: fix: improve SSRF resolved-IP error message with remediation hint (#65153)

Description (problem / solution / changelog)

Summary

The error message Blocked: resolves to private/internal/special-use IP address is triggered in several real-world scenarios (most commonly api.telegram.org resolving through transparent proxies or certain cloud environments) but gives the user zero actionable guidance.

OpenClaw already ships dangerouslyAllowPrivateNetwork: true under channels.<plugin>.network for exactly this case, but nothing in the error path tells the user it exists.

Change

Append a remediation hint to BLOCKED_RESOLVED_IP_MESSAGE so the error self-documents the fix.

Before:

Blocked: resolves to private/internal/special-use IP address

After:

Blocked: resolves to private/internal/special-use IP address. If this is a trusted
service (e.g. api.telegram.org), set channels.<plugin>.network.dangerouslyAllowPrivateNetwork:
true in openclaw.json.

Why only BLOCKED_RESOLVED_IP_MESSAGE?

BLOCKED_HOST_OR_IP_MESSAGE (pre-DNS check) fires for hostnames/IPs that are statically private (e.g. 192.168.x.x typed directly). That case is genuinely suspicious. The resolved-IP check fires post-DNS and is the one that catches legitimate public services routed through network infrastructure — that's the case worth guiding.

Related

Fixes #65153

Changed files

  • src/cron/isolated-agent/model-selection.ts (modified, +55/-9)
  • src/infra/net/ssrf.ts (modified, +4/-1)

Code Example

[security] blocked URL fetch 
target: api.telegram.org/file/...voice/file_218.oga
reason: Blocked: resolves to private/internal/special-use IP address
RAW_BUFFERClick to expand / collapse

描述: Telegram 语音和图片无法下载，被安全系统误判为 private IP

复现步骤:

  1. 通过 Telegram 发送语音消息给机器人
  2. 机器人无法下载语音文件

日志错误:

[security] blocked URL fetch 
target: api.telegram.org/file/...voice/file_218.oga
reason: Blocked: resolves to private/internal/special-use IP address

环境:

  • OpenClaw: 2026.4.9
  • Telegram bot: enabled

预期行为: Telegram media URL 应该被允许下载

实际行为: 所有 Telegram API 文件下载都被阻止

extent analysis

TL;DR

  • Whitelisting the Telegram API domain or adjusting the security system's IP blocking rules may resolve the issue with downloading voice and image files.

Guidance

  • Review the security system's configuration to understand why api.telegram.org is being resolved to a private/internal/special-use IP address.
  • Check if there are any specific IP ranges or domains that need to be whitelisted to allow Telegram media downloads.
  • Verify if the issue persists when using a different version of OpenClaw or if there are any known issues with the current version (2026.4.9) related to IP blocking.
  • Consider temporarily disabling the IP blocking feature for the Telegram bot to test if it's the cause of the problem.

Example

No specific code snippet can be provided without more details on the security system's configuration or the OpenClaw version's API.

Notes

The solution may vary depending on the specific security system and network configuration in use. It's also possible that the issue is not with the OpenClaw version but with how the Telegram API is being resolved or blocked.

Recommendation

Apply workaround: Adjust the security system's IP blocking rules to whitelist the Telegram API domain or necessary IP ranges, as this seems to be the most direct approach to resolving the issue without upgrading OpenClaw, which may not be necessary.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#api#ISR setup#authentication setup#request error#file not found

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING