openclaw - 💡(How to fix) Fix web_fetch SSRF policy allowRfc2544BenchmarkRange not effective in 2026.5.12

Bug Report: web_fetch SSRF policy allowRfc2544BenchmarkRange not effective in 2026.5.12

Summary

The tools.web.fetch.ssrfPolicy.allowRfc2544BenchmarkRange configuration option, documented as a workaround for FakeIP/proxy environments, does not actually prevent SSRF blocking when accessing domains that resolve to RFC 2544 benchmark range (198.18.0.0/15) due to DNS hijacking/pollution.

Environment

• OpenClaw Version: 2026.5.12
• OS: WSL2 (Ubuntu on Windows)
• Network Setup: Proxy with DNS hijacking (Clash/Surge fake-ip mode)
• Proxy URL: http://192.168.3.100:7897

Current Configuration

{
  "proxy": {
    "enabled": true,
    "proxyUrl": "http://192.168.3.100:7897"
  },
  "tools": {
    "web": {
      "fetch": {
        "ssrfPolicy": {
          "allowRfc2544BenchmarkRange": true
        }
      }
    }
  }
}

Steps to Reproduce

1. Configure OpenClaw with a proxy that uses FakeIP/DNS hijacking (e.g., Clash, Surge, Mihomo)
2. Add tools.web.fetch.ssrfPolicy.allowRfc2544BenchmarkRange: true to config
3. Restart OpenClaw gateway
4. Attempt to fetch a domain that requires proxy (e.g., Google, DuckDuckGo)

await web_fetch({ url: "https://www.google.com", maxChars: 200 })

Expected Behavior

With allowRfc2544BenchmarkRange: true, domains resolving to 198.18.0.0/15 (RFC 2544 benchmark range) should be allowed through when behind a trusted FakeIP proxy.

Actual Behavior

{
  "status": "error",
  "tool": "web_fetch",
  "error": "Blocked: resolves to private/internal/special-use IP address"
}

Root Cause Analysis

The SSRF guard appears to perform DNS resolution locally before the proxy request, blocking the request at the DNS resolution stage. The ssrfPolicy configuration may not be properly wired into the SSRF guard logic for web_fetch.

Verification

The proxy is correctly configured and working (verified via httpbin.org), but web_fetch still blocks Google despite allowRfc2544BenchmarkRange: true.

Related Issues

• #62178 - web_fetch still fails in FakeIP environments on 2026.4.5
• #26847, #48080, #48961, #25215, #29669

Impact

Users in regions with DNS pollution (e.g., mainland China) who rely on proxy tools with FakeIP mode cannot use web_fetch for accessing international services like Google, DuckDuckGo, etc., even with the documented workaround enabled.

Workaround

Currently must use curl command-line tool instead of web_fetch for proxied requests:

curl -sL "URL" -x http://proxy:port

Suggested Fix

Either:

1. Ensure ssrfPolicy.allowRfc2544BenchmarkRange is properly respected by web_fetch's SSRF guard
2. Or defer SSRF checks until after proxy resolution (trust proxy to resolve real IPs)
3. Or add a broader dangerouslyAllowPrivateNetwork option for trusted proxy environments