Issue Station
Sign In
Tools hereToolbox

openclaw - 💡(How to fix) Fix [Bug]: web_fetch blocked when DNS returns FakeIP/special-use address [2 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#48906•Fetched 2026-04-08 00:51:13
View on GitHub
Comments
2
Participants
2
Timeline
4
Reactions
0
Author
goxofygoxofy
Participants
goxofygoxofyRyceRyce
Timeline (top)
commented ×2subscribed ×2

web_fetch blocks when a public domain resolves to a special-use IP (FakeIP), returning "Blocked: resolves to private/internal/special-use IP address", even though the domain is public.

Error Message

  1. Observe the error: "Blocked: resolves to private/internal/special-use IP address".
  • the error explicitly calls out FakeIP/DNS interception as a likely cause and suggests disabling FakeIP or allowing a whitelist/override. Error: Blocked: resolves to private/internal/special-use IP address Likely triggered by FakeIP or DNS interception; could consider improved error messaging or allowlist/override for special-use IPs.

Root Cause

web_fetch blocks when a public domain resolves to a special-use IP (FakeIP), returning "Blocked: resolves to private/internal/special-use IP address", even though the domain is public.

RAW_BUFFERClick to expand / collapse

Bug type

Behavior bug (incorrect output/state without crash)

Summary

web_fetch blocks when a public domain resolves to a special-use IP (FakeIP), returning "Blocked: resolves to private/internal/special-use IP address", even though the domain is public.

Steps to reproduce

  1. Enable FakeIP / DNS interception (e.g., Clash/Tailscale/other).
  2. Run web_fetch on https://opencode.ai/zh/go or https://opencode.ai/zh/zen.
  3. Observe the error: "Blocked: resolves to private/internal/special-use IP address".
  4. dig +short opencode.ai returns 198.18.0.108 (198.18.0.0/15 special-use range).

Expected behavior

Either:

  • web_fetch succeeds for public domains even if FakeIP is used, or
  • the error explicitly calls out FakeIP/DNS interception as a likely cause and suggests disabling FakeIP or allowing a whitelist/override.

Actual behavior

web_fetch fails with: "Blocked: resolves to private/internal/special-use IP address".

OpenClaw version

2026.3.13 (61d171a)

Operating system

macOS 14.8.3 (23J220)

Install method

N/A (standard local install)

Model

N/A (web_fetch tool)

Provider / routing chain

N/A (web_fetch tool)

Config file / key location

N/A

Additional provider/model setup details

N/A

Logs, screenshots, and evidence

Error: Blocked: resolves to private/internal/special-use IP address DNS: opencode.ai -> 198.18.0.108 (198.18.0.0/15 special-use range)

Impact and severity

Affected: any environment using FakeIP/DNS interception Severity: Medium (web_fetch unusable for some public domains) Frequency: 100% for domains mapped to FakeIP Consequence: web_fetch cannot access public URLs in these setups

Additional information

Likely triggered by FakeIP or DNS interception; could consider improved error messaging or allowlist/override for special-use IPs.

extent analysis

Fix Plan

To resolve the issue, we need to modify the web_fetch tool to either:

  • Allow special-use IPs for public domains
  • Provide explicit error messaging when FakeIP/DNS interception is detected

Here are the steps to fix the issue:

  • Modify the IP blocking logic to check if the domain is public before blocking special-use IPs
  • Add a whitelist or override mechanism for special-use IPs

Example code snippet (in Python):

import ipaddress

def is_public_domain(domain):
    # Check if the domain is public
    # This can be done using a DNS query or a public domain list
    return True  # Replace with actual implementation

def is_special_use_ip(ip):
    # Check if the IP is in a special-use range
    special_use_ranges = [ipaddress.ip_network('198.18.0.0/15')]
    return any(ip in network for network in special_use_ranges)

def web_fetch(url):
    # Get the IP address of the URL
    ip = get_ip_address(url)
    
    # Check if the IP is special-use
    if is_special_use_ip(ip):
        # Check if the domain is public
        if is_public_domain(url):
            # Allow the request
            return fetch_url(url)
        else:
            # Block the request with an explicit error message
            raise Exception("Blocked: resolves to private/internal/special-use IP address. Possible FakeIP/DNS interception.")
    else:
        # Allow the request
        return fetch_url(url)

Verification

To verify the fix, run the web_fetch tool with the modified code and test it with a public domain that resolves to a special-use IP. The tool should either succeed or provide an explicit error message indicating possible FakeIP/DNS interception.

Extra Tips

  • Consider adding a configuration option to allow users to enable or disable the special-use IP override
  • Use a reliable public domain list or DNS query to determine if a domain is public
  • Test the fix with different special-use IP ranges and public domains to ensure it works as expected.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

Either:

  • web_fetch succeeds for public domains even if FakeIP is used, or
  • the error explicitly calls out FakeIP/DNS interception as a likely cause and suggests disabling FakeIP or allowing a whitelist/override.
#api#ssr#installation#tensor shape#autograd error#parallel task#integration issue#index setup#retrieval issue#search optimization

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING