openclaw - 💡(How to fix) Fix web_fetch SSRF guard blocks fake-IP proxy ranges (198.18.0.0/15) - no user-configurable bypass [1 participants]

Blocked: resolves to private/internal/special-use IP address

TL;DR

To resolve the web_fetch blockage, add ssrfPolicy to the tools.web.fetch schema and include allowRfc2544BenchmarkRange as an option to allow DNS resolution through fake-IP transparent proxies.

Guidance

• Verify that the issue is caused by the SSRF guard blocking special-use IP addresses by checking the error message for "Blocked: resolves to private/internal/special-use IP address".
• Update the tools.web.fetch schema to include ssrfPolicy and add allowRfc2544BenchmarkRange as an option to enable DNS resolution through fake-IP transparent proxies.
• Consider using the proposed workaround of disabling fake-IP mode in the local proxy software or using alternative methods like web_search or agent-browser skill.
• Ensure that the allowRfc2544BenchmarkRange option is properly passed to the SSRF guard when web_fetch performs DNS resolution.

Example

No code example is provided as the issue does not require a specific code snippet to illustrate the solution.

Notes

The proposed fix requires updating the schema and passing the configured ssrfPolicy to the SSRF guard, which may involve modifying the existing codebase. The workaround provides an alternative solution for users who cannot update the schema.

Recommendation

Apply the workaround by disabling fake-IP mode in the local proxy software or using alternative methods like web_search or agent-browser skill, as this provides a temporary solution until the schema can be updated.