Repository navigation
network: direct egress reaches relays configured by literal address - #53
Merged
Merged
Conversation
A relay named by IP got no bridge rules, so its flows never carried the relay forward mark and the private-destination denies dropped them: an open-network sandbox could not reach a literal relay at all. Hetzner names its relays by IP (no private DNS), so evals there timed out connecting to the model relay. Mark those flows too; no translation is needed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Open-network (direct-egress) sandboxes reach a relay through
bridge_forward, which marks the relay's flows so they get past the private-destination denies. A relay configured by literal IP got no bridge rules at all ("its virtual address is that address"), so its flows were never marked and10.0.0.0/8DROP took them.Hetzner configures its relays by IP because it has no private DNS. Every eval harness in an open-network sandbox there timed out connecting to the model relay (swebench-verified, terminal-bench-2, openthoughts-tblite, senior-swe-bench).
bridge_forwardmark rule. They need no translation.Prod is already worked around with
sandbox.direct_network_allow_tcp. Once this ships in a worker bundle, that setting can go.🤖 Generated with Claude Code