Issue Station
Sign In
Tools hereToolbox

openclaw - 💡(How to fix) Fix web_fetch still fails in FakeIP environments on 2026.4.5 (`Blocked: resolves to private/internal/special-use IP address`) [1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#62178•Fetched 2026-04-08 03:08:00
View on GitHub
Comments
0
Participants
1
Timeline
0
Reactions
0
Author
thinktipthinktip
Participants
thinktipthinktip

Code Example

Blocked: resolves to private/internal/special-use IP address

---

await web_fetch({
  url: "https://developer.apple.com/news/releases/",
  extractMode: "text",
  maxChars: 4000
})

---

const WEB_TOOLS_TRUSTED_NETWORK_SSRF_POLICY = {
  dangerouslyAllowPrivateNetwork: true,
  allowRfc2544BenchmarkRange: true
};
RAW_BUFFERClick to expand / collapse

web_fetch is still unusable behind Surge/Clash/Mihomo FakeIP DNS on OpenClaw 2026.4.5.

In FakeIP mode, public domains resolve to 198.18.0.0/15 (RFC 2544 benchmark range), and web_fetch fails with:

Blocked: resolves to private/internal/special-use IP address

Example:

await web_fetch({
  url: "https://developer.apple.com/news/releases/",
  extractMode: "text",
  maxChars: 4000
})

This is not an Apple-side anti-bot issue — direct HTTP requests to the same URL return 200 OK.

I checked local 2026.4.5 code and found that OpenClaw already has internal support for RFC2544-aware trusted web-tool policy:

const WEB_TOOLS_TRUSTED_NETWORK_SSRF_POLICY = {
  dangerouslyAllowPrivateNetwork: true,
  allowRfc2544BenchmarkRange: true
};

But web_fetch still appears to go through strict SSRF guard instead of using that trusted path.

Expected fix:

  • either make web_fetch use the existing trusted RFC2544-aware policy
  • or expose ssrfPolicy / allowRfc2544BenchmarkRange config for tools.web.fetch

This seems related to: #26847 #48080 #48961 #25215 #29669

Environment:

  • OpenClaw 2026.4.5
  • macOS 15.7.4
  • Surge FakeIP / Enhanced Mode
  • same issue should reproduce under Clash/Mihomo FakeIP setups too

extent analysis

TL;DR

Modify the web_fetch function to utilize the existing trusted RFC2544-aware policy or expose the ssrfPolicy configuration to allow bypassing the strict SSRF guard.

Guidance

  • Review the OpenClaw code to ensure the WEB_TOOLS_TRUSTED_NETWORK_SSRF_POLICY is correctly applied to the web_fetch function.
  • Verify that the dangerouslyAllowPrivateNetwork and allowRfc2544BenchmarkRange settings are enabled and properly configured.
  • Consider exposing the ssrfPolicy configuration for tools.web.fetch to allow users to customize the SSRF guard settings.
  • Test the web_fetch function with the suggested changes to confirm that it can successfully fetch content from public domains while using FakeIP mode.

Example

// Example of exposing ssrfPolicy configuration
const webFetchOptions = {
  url: "https://developer.apple.com/news/releases/",
  extractMode: "text",
  maxChars: 4000,
  ssrfPolicy: {
    dangerouslyAllowPrivateNetwork: true,
    allowRfc2544BenchmarkRange:

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#api#ssr#installation#tensor shape#autograd error

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING