Discord bot failing to fetch image attachments due to SSRF protection under VPN/Proxy Tun mode
Hi!
I'm running into a strict SSRF blocking issue with Discord image attachments in the latest versions (2026.2.24).
My setup:
OpenClaw v2026.2.24
Host OS: Windows (running local gateway)
Network: Using a proxy client (Clash Verge) with Tun mode enabled globally.
The Issue:
When I send an image attachment to the bot via Discord DM, the gateway intercepts the cdn.discordapp.com link but immediately blocks it, throwing this error in the logs:
[security] blocked URL fetch (url-fetch) target=https://cdn.discordapp.com/attachments/.../IMG.jpg reason=Blocked: resolves to private/internal/special-use IP address
Because Tun mode hijacks DNS and routes everything through a fake local/loopback IP (e.g., 198.18.x.x or 127.x.x.x), the new strict SSRF protection treats the Discord CDN URL as a private network scan and instantly kills the fetch request. The agent ends up receiving a stripped <media:image> tag without the actual image payload.
What I've tried:
Setting channels.discord.proxy: "http://127.0.0.1:7897" (my local proxy port). However, this causes the gateway event queue to time out (DiscordMessageListener took 30000ms...) or throws 403 Forbidden from the Python/Node fetch layer.
Looking for a break-glass config like security.dangerouslyAllowInternalFetch or similar for URL fetching, but I only found browser.ssrfPolicy which doesn't seem to apply to Discord attachments.
Question:
Is there a recommended way or configuration to bypass this SSRF block for cdn.discordapp.com while maintaining Tun mode? Or is there a specific way to force the Discord attachment fetcher to properly route through a local HTTP/SOCKS5 proxy without timing out the MESSAGE_CREATE event queue?
Any help would be greatly appreciated!
I'm running into a strict SSRF blocking issue with Discord image attachments in the latest versions (2026.2.24).
My setup:
OpenClaw v2026.2.24
Host OS: Windows (running local gateway)
Network: Using a proxy client (Clash Verge) with Tun mode enabled globally.
The Issue:
When I send an image attachment to the bot via Discord DM, the gateway intercepts the cdn.discordapp.com link but immediately blocks it, throwing this error in the logs:
[security] blocked URL fetch (url-fetch) target=https://cdn.discordapp.com/attachments/.../IMG.jpg reason=Blocked: resolves to private/internal/special-use IP address
Because Tun mode hijacks DNS and routes everything through a fake local/loopback IP (e.g., 198.18.x.x or 127.x.x.x), the new strict SSRF protection treats the Discord CDN URL as a private network scan and instantly kills the fetch request. The agent ends up receiving a stripped <media:image> tag without the actual image payload.
What I've tried:
Setting channels.discord.proxy: "http://127.0.0.1:7897" (my local proxy port). However, this causes the gateway event queue to time out (DiscordMessageListener took 30000ms...) or throws 403 Forbidden from the Python/Node fetch layer.
Looking for a break-glass config like security.dangerouslyAllowInternalFetch or similar for URL fetching, but I only found browser.ssrfPolicy which doesn't seem to apply to Discord attachments.
Question:
Is there a recommended way or configuration to bypass this SSRF block for cdn.discordapp.com while maintaining Tun mode? Or is there a specific way to force the Discord attachment fetcher to properly route through a local HTTP/SOCKS5 proxy without timing out the MESSAGE_CREATE event queue?
Any help would be greatly appreciated!
The AI that actually does things. Emails, calendar, home automation - all from your favorite chat app. New shell, ready to help. The lobster way.
130,529Members
Resources
Similar Threads
Was this page helpful?
