Skip to main content

Fix a blocked connection

A step fails with a connection error after you turn on block mode. Identify what Bullfrog dropped and either allowlist it or leave it blocked.

Before you begin​

  • A failed run of a job using egress-policy: block

Step 1: Find the blocked row​

Open the run's job summary and look for rows with a 🚫 Blocked status. Match the timestamp against the step that failed. See Review connections in a job summary.

The Reason column tells you which check refused the connection, and that determines the fix.

Step 2: Apply the fix for that reason​

Domain not allowed​

The hostname isn't in allowed-domains. Add it:

allowed-domains: |
  registry.npmjs.org

A wildcard entry doesn't cover the apex domain. If *.example.com is allowlisted and example.com was blocked, add example.com as its own line.

IP not allowed​

The step connected to an address directly, and it isn't in allowed-ips. Add the address or its range:

allowed-ips: |
  203.0.113.10
  198.51.100.0/24

Untrusted DNS server​

The job resolves names through a DNS server that isn't allowlisted. Add the resolver's address to allowed-ips. See Use a custom DNS server.

Step 3: Handle a blocked lookup for an allowlisted address​

A step fails to resolve a hostname even though you allowlisted the address behind it. The default dns-policy is allowed-domains-only, so Bullfrog blocks the lookup before the connection is ever attempted. Allowlist the domain too, or set dns-policy: any. See Reach an allowlisted IP address by hostname.

Step 4: Handle a connection with no row at all​

If a step fails to reach the network and nothing appears in the summary, Bullfrog probably didn't run for that step.

  • Bullfrog isn't the first step. Connections made before the action runs are neither recorded nor filtered, including those made by actions/checkout. Move the Bullfrog step to the top of the job.
  • The job doesn't run on a supported runner. Check the job's runs-on against Supported runners.
  • The job runs in a container. Container jobs aren't supported. Run the container as a step instead.

Step 5: Decide whether to allowlist at all​

A blocked connection is not always a mistake. Before adding an entry, check the Process, Exe Path, and Command Line columns. If you can't explain which step wanted that destination and why, leave it blocked and investigate. That's the signal Bullfrog exists to give you.

Get help​

See also​