langgenius/dify
1
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-07-21 20:15:31 -04:00
Code Issues 775 Packages Projects Releases 10 Wiki Activity

Run failed: [Errno 111] Connection refused #20566

New Issue
Closed
opened 2026-02-21 20:07:59 -05:00 by yindo · 7 comments
yindo commented 2026-02-21 20:07:59 -05:00
Owner
Copy Link
Copy Source

Originally created by @liaoduanyong on GitHub (Nov 26, 2025).

Self Checks

  • I have read the Contributing Guide and Language Policy.
  • I have searched for existing issues search for existing issues, including closed ones.
  • I confirm that I am using English to submit this report, otherwise it will be closed.
  • Please do not modify this template :) and fill in all the required fields.

1. Is this request related to a challenge you're experiencing? Tell me about your story.

Image HTTP REQUEST node request error: Run failed: [Errno 111] Connection refused

2. Additional context or comments

No response

3. Can you help us with this feature?

  • I am interested in contributing to this feature.
Originally created by @liaoduanyong on GitHub (Nov 26, 2025). ### Self Checks - [x] I have read the [Contributing Guide](https://github.com/langgenius/dify/blob/main/CONTRIBUTING.md) and [Language Policy](https://github.com/langgenius/dify/issues/1542). - [x] I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify/issues), including closed ones. - [x] I confirm that I am using English to submit this report, otherwise it will be closed. - [x] Please do not modify this template :) and fill in all the required fields. ### 1. Is this request related to a challenge you're experiencing? Tell me about your story. <img width="1273" height="493" alt="Image" src="https://github.com/user-attachments/assets/9aefd669-93e7-46a6-a46f-c5ec6e4e4774" /> HTTP REQUEST node request error: Run failed: [Errno 111] Connection refused ### 2. Additional context or comments _No response_ ### 3. Can you help us with this feature? - [x] I am interested in contributing to this feature.
yindo added the 🐞 bug🤔 cant-reproduce labels 2026-02-21 20:07:59 -05:00
yindo closed this issue 2026-02-21 20:07:59 -05:00
yindo commented 2026-02-21 20:07:59 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Nov 26, 2025):

The [Errno 111] Connection refused error means the workflow's HTTP request node couldn't connect to the server at 192.168.56.66:5011. This usually happens because the target service isn't running, is listening on a different port/interface, or is blocked by network, firewall, or Docker proxy settings.

For Dify (especially in Docker/self-hosted setups), the most common causes are: the service isn't running or is only listening on localhost, Docker network isolation, the Squid proxy (ssrf_proxy) blocking internal addresses, or misconfigured environment variables like FILES_URL or PLUGIN_DAEMON_URL [source 1] [source 2].

Here's a troubleshooting checklist:

  1. Make sure the server at 192.168.56.66:5011 is running and listening on all interfaces (0.0.0.0), not just localhost.
  2. If running Dify in Docker, use the host's LAN IP or host.docker.internal in your URLs and environment variables instead of localhost or 127.0.0.1 [source].
  3. Update the Squid proxy ACLs in docker/ssrf_proxy/squid.conf.template to allow access to your internal network, then restart the ssrf_proxy container [source].
  4. Unset any HTTP_PROXY or HTTPS_PROXY environment variables if set, as they can interfere with internal networking.
  5. Restart all Docker services after making changes.
  6. Test connectivity from inside the relevant container using curl to the target URL.
  7. Check backend and proxy logs for more details, and enable debug logging (DEBUG=true) for more verbose output.

Recent Dify versions improved error handling in the HTTP Request node, so you should see more detailed error output in the workflow UI or logs if the problem persists [source].

If you need to access internal domains, you may also need to add extra_hosts entries in your docker-compose.yaml to map internal domains to IPs [source].

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other

Chat with Dosu Open in Cursor Join Discord Share on X

@dosubot[bot] commented on GitHub (Nov 26, 2025): <!-- Answer --> The `[Errno 111] Connection refused` error means the workflow's HTTP request node couldn't connect to the server at `192.168.56.66:5011`. This usually happens because the target service isn't running, is listening on a different port/interface, or is blocked by network, firewall, or Docker proxy settings. For Dify (especially in Docker/self-hosted setups), the most common causes are: the service isn't running or is only listening on `localhost`, Docker network isolation, the Squid proxy (ssrf_proxy) blocking internal addresses, or misconfigured environment variables like `FILES_URL` or `PLUGIN_DAEMON_URL` [[source 1]](https://github.com/langgenius/dify/issues/19859) [[source 2]](https://github.com/langgenius/dify/issues/22612). Here's a troubleshooting checklist: 1. Make sure the server at `192.168.56.66:5011` is running and listening on all interfaces (`0.0.0.0`), not just `localhost`. 2. If running Dify in Docker, use the host's LAN IP or `host.docker.internal` in your URLs and environment variables instead of `localhost` or `127.0.0.1` [[source]](https://github.com/langgenius/dify/issues/19338). 3. Update the Squid proxy ACLs in `docker/ssrf_proxy/squid.conf.template` to allow access to your internal network, then restart the `ssrf_proxy` container [[source]](https://github.com/langgenius/dify/issues/22612). 4. Unset any `HTTP_PROXY` or `HTTPS_PROXY` environment variables if set, as they can interfere with internal networking. 5. Restart all Docker services after making changes. 6. Test connectivity from inside the relevant container using `curl` to the target URL. 7. Check backend and proxy logs for more details, and enable debug logging (`DEBUG=true`) for more verbose output. Recent Dify versions improved error handling in the HTTP Request node, so you should see more detailed error output in the workflow UI or logs if the problem persists [[source]](https://github.com/langgenius/dify/pull/27610). If you need to access internal domains, you may also need to add `extra_hosts` entries in your `docker-compose.yaml` to map internal domains to IPs [[source]](https://github.com/langgenius/dify/issues/22612). <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/2581b6f6-e400-4fff-81ee-0f6ee58d9bdd?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/2581b6f6-e400-4fff-81ee-0f6ee58d9bdd?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/2581b6f6-e400-4fff-81ee-0f6ee58d9bdd?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/2581b6f6-e400-4fff-81ee-0f6ee58d9bdd?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/2581b6f6-e400-4fff-81ee-0f6ee58d9bdd?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/2581b6f6-e400-4fff-81ee-0f6ee58d9bdd?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/2581b6f6-e400-4fff-81ee-0f6ee58d9bdd?feedback_type=other)</sup> [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/6088a4f4-073a-43f3-b3d4-4f06fb0c05a0/ask?utm_source=github)&nbsp;[![Open in Cursor](https://dosu.dev/dosu-in-cursor.svg)](https://cursor.com/link/prompt?text=The%20%60%5BErrno%20111%5D%20Connection%20refused%60%20error%20means%20the%20workflow%27s%20HTTP%20request%20node%20couldn%27t%20connect%20to%20the%20server%20at%20%60192.168.56.66%3A5011%60.%20This%20usually%20happens%20because%20the%20target%20service%20isn%27t%20running%2C%20is%20listening%20on%20a%20different%20port/interface%2C%20or%20is%20blocked%20by%20network%2C%20firewall%2C%20or%20Docker%20proxy%20settings.%0A%0AFor%20Dify%20%28especially%20in%20Docker/self-hosted%20setups%29%2C%20the%20most%20common%20causes%20are%3A%20the%20service%20isn%27t%20running%20or%20is%20only%20listening%20on%20%60localhost%60%2C%20Docker%20network%20isolation%2C%20the%20Squid%20proxy%20%28ssrf_proxy%29%20blocking%20internal%20addresses%2C%20or%20misconfigured%20environment%20variables%20like%20%60FILES_URL%60%20or%20%60PLUGIN_DAEMON_URL%60%20%5B%5Bsource%201%5D%5D%28https%3A//github.com/langgenius/dify/issues/19859%29%20%5B%5Bsource%202%5D%5D%28https%3A//github.com/langgenius/dify/issues/22612%29.%0A%0AHere%27s%20a%20troubleshooting%20checklist%3A%0A%0A1.%20Make%20sure%20the%20server%20at%20%60192.168.56.66%3A5011%60%20is%20running%20and%20listening%20on%20all%20interfaces%20%28%600.0.0.0%60%29%2C%20not%20just%20%60localhost%60.%0A2.%20If%20running%20Dify%20in%20Docker%2C%20use%20the%20host%27s%20LAN%20IP%20or%20%60host.docker.internal%60%20in%20your%20URLs%20and%20environment%20variables%20instead%20of%20%60localhost%60%20or%20%60127.0.0.1%60%20%5B%5Bsource%5D%5D%28https%3A//github.com/langgenius/dify/issues/19338%29.%0A3.%20Update%20the%20Squid%20proxy%20ACLs%20in%20%60docker/ssrf_proxy/squid.conf.template%60%20to%20allow%20access%20to%20your%20internal%20network%2C%20then%20restart%20the%20%60ssrf_proxy%60%20container%20%5B%5Bsource%5D%5D%28https%3A//github.com/langgenius/dify/issues/22612%29.%0A4.%20Unset%20any%20%60HTTP_PROXY%60%20or%20%60HTTPS_PROXY%60%20environment%20variables%20if%20set%2C%20as%20they%20can%20interfere%20with%20internal%20networking.%0A5.%20Restart%20all%20Docker%20services%20after%20making%20changes.%0A6.%20Test%20connectivity%20from%20inside%20the%20relevant%20container%20using%20%60curl%60%20to%20the%20target%20URL.%0A7.%20Check%20backend%20and%20proxy%20logs%20for%20more%20details%2C%20and%20enable%20debug%20logging%20%28%60DEBUG%3Dtrue%60%29%20for%20more%20verbose%20output.%0A%0ARecent%20Dify%20versions%20improved%20error%20handling%20in%20the%20HTTP%20Request%20node%2C%20so%20you%20should%20see%20more%20detailed%20error%20output%20in%20the%20workflow%20UI%20or%20logs%20if%20the%20problem%20persists%20%5B%5Bsource%5D%5D%28https%3A//github.com/langgenius/dify/pull/27610%29.%0A%0AIf%20you%20need%20to%20access%20internal%20domains%2C%20you%20may%20also%20need%20to%20add%20%60extra_hosts%60%20entries%20in%20your%20%60docker-compose.yaml%60%20to%20map%20internal%20domains%20to%20IPs%20%5B%5Bsource%5D%5D%28https%3A//github.com/langgenius/dify/issues/22612%29.)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/28691)
yindo commented 2026-02-21 20:07:59 -05:00
Author
Owner
Copy Link
Copy Source

@liaoduanyong commented on GitHub (Nov 26, 2025):

Image 192.168.56.66:5011 is running
@liaoduanyong commented on GitHub (Nov 26, 2025): <img width="956" height="268" alt="Image" src="https://github.com/user-attachments/assets/f7cf73b2-587d-4d9d-8e4f-114f1ee683b8" /> 192.168.56.66:5011 is running
yindo commented 2026-02-21 20:07:59 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Nov 26, 2025):

Your server is running and accessible from your host, but Dify workflow HTTP requests are made from inside a Docker container and routed through a Squid proxy (ssrf_proxy). This means network access can differ from what you see on your host.

Here’s what to do next:

  1. Enter your Dify container (like api or worker) and run:
    curl http://192.168.56.66:5011/read_customer_file/
    If this fails, it confirms a container networking or proxy issue.

  2. If the curl fails inside the container, check:

    • That your container is on the correct Docker network and the target port is exposed.
    • The Squid proxy ACLs in docker/ssrf_proxy/squid.conf.template allow access to 192.168.56.66. Update and restart the ssrf_proxy container if needed.
    • Your .env and docker-compose.yaml for proxy-related variables like SSRF_PROXY_HTTP_URL, HTTP_PROXY, or HTTPS_PROXY. Remove unnecessary proxy configs and restart all containers if you find any—this has resolved similar issues for others (source).

  3. Check Dify and proxy logs for more details, and set DEBUG=true for more verbose output if you need to dig deeper.

Let me know what you find from inside the container or if you need help interpreting logs.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other

Chat with Dosu Open in Cursor Join Discord Share on X

@dosubot[bot] commented on GitHub (Nov 26, 2025): <!-- Answer --> Your server is running and accessible from your host, but Dify workflow HTTP requests are made from inside a Docker container and routed through a Squid proxy (ssrf_proxy). This means network access can differ from what you see on your host. Here’s what to do next: 1. Enter your Dify container (like api or worker) and run: `curl http://192.168.56.66:5011/read_customer_file/` If this fails, it confirms a container networking or proxy issue. 2. If the curl fails inside the container, check: - That your container is on the correct Docker network and the target port is exposed. - The Squid proxy ACLs in `docker/ssrf_proxy/squid.conf.template` allow access to `192.168.56.66`. Update and restart the `ssrf_proxy` container if needed. - Your `.env` and `docker-compose.yaml` for proxy-related variables like `SSRF_PROXY_HTTP_URL`, `HTTP_PROXY`, or `HTTPS_PROXY`. Remove unnecessary proxy configs and restart all containers if you find any—this has resolved similar issues for others ([source](https://github.com/langgenius/dify/issues/20838)). 3. Check Dify and proxy logs for more details, and set `DEBUG=true` for more verbose output if you need to dig deeper. Let me know what you find from inside the container or if you need help interpreting logs. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/0ce7c27b-5e97-4c3a-aaee-b1cda89611f5?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/0ce7c27b-5e97-4c3a-aaee-b1cda89611f5?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/0ce7c27b-5e97-4c3a-aaee-b1cda89611f5?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/0ce7c27b-5e97-4c3a-aaee-b1cda89611f5?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/0ce7c27b-5e97-4c3a-aaee-b1cda89611f5?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/0ce7c27b-5e97-4c3a-aaee-b1cda89611f5?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/0ce7c27b-5e97-4c3a-aaee-b1cda89611f5?feedback_type=other)</sup> [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/6088a4f4-073a-43f3-b3d4-4f06fb0c05a0/ask?utm_source=github)&nbsp;[![Open in Cursor](https://dosu.dev/dosu-in-cursor.svg)](https://cursor.com/link/prompt?text=Your%20server%20is%20running%20and%20accessible%20from%20your%20host%2C%20but%20Dify%20workflow%20HTTP%20requests%20are%20made%20from%20inside%20a%20Docker%20container%20and%20routed%20through%20a%20Squid%20proxy%20%28ssrf_proxy%29.%20This%20means%20network%20access%20can%20differ%20from%20what%20you%20see%20on%20your%20host.%0A%0AHere%E2%80%99s%20what%20to%20do%20next%3A%0A%0A1.%20Enter%20your%20Dify%20container%20%28like%20api%20or%20worker%29%20and%20run%3A%20%20%0A%20%20%20%60curl%20http%3A//192.168.56.66%3A5011/read_customer_file/%60%20%20%0A%20%20%20If%20this%20fails%2C%20it%20confirms%20a%20container%20networking%20or%20proxy%20issue.%0A%0A2.%20If%20the%20curl%20fails%20inside%20the%20container%2C%20check%3A%0A%20%20%20-%20That%20your%20container%20is%20on%20the%20correct%20Docker%20network%20and%20the%20target%20port%20is%20exposed.%0A%20%20%20-%20The%20Squid%20proxy%20ACLs%20in%20%60docker/ssrf_proxy/squid.conf.template%60%20allow%20access%20to%20%60192.168.56.66%60.%20Update%20and%20restart%20the%20%60ssrf_proxy%60%20container%20if%20needed.%0A%20%20%20-%20Your%20%60.env%60%20and%20%60docker-compose.yaml%60%20for%20proxy-related%20variables%20like%20%60SSRF_PROXY_HTTP_URL%60%2C%20%60HTTP_PROXY%60%2C%20or%20%60HTTPS_PROXY%60.%20Remove%20unnecessary%20proxy%20configs%20and%20restart%20all%20containers%20if%20you%20find%20any%E2%80%94this%20has%20resolved%20similar%20issues%20for%20others%20%28%5Bsource%5D%28https%3A//github.com/langgenius/dify/issues/20838%29%29.%0A%0A3.%20Check%20Dify%20and%20proxy%20logs%20for%20more%20details%2C%20and%20set%20%60DEBUG%3Dtrue%60%20for%20more%20verbose%20output%20if%20you%20need%20to%20dig%20deeper.%0A%0ALet%20me%20know%20what%20you%20find%20from%20inside%20the%20container%20or%20if%20you%20need%20help%20interpreting%20logs.)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/28691)
yindo commented 2026-02-21 20:07:59 -05:00
Author
Owner
Copy Link
Copy Source

@liaoduanyong commented on GitHub (Nov 26, 2025):

Image I config ssrf_proxy, acl localnet src 192.168.56.66 still report error, still [[Errno 111] Connection refused]
@liaoduanyong commented on GitHub (Nov 26, 2025): <img width="823" height="421" alt="Image" src="https://github.com/user-attachments/assets/1fdde4a5-65a7-40f1-a3a2-ac8960917039" /> I config ssrf_proxy, acl localnet src 192.168.56.66 still report error, still [[Errno 111] Connection refused]
yindo commented 2026-02-21 20:07:59 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Nov 26, 2025):

The ACL entry for 192.168.56.66 alone isn't enough—Squid also blocks CONNECT requests to ports not explicitly allowed. Make sure your squid.conf.template includes a line like acl SSL_ports port 5011 (or add 5011 to an existing SSL_ports line), and that it's not commented out or overridden by a later rule. This line must appear before any http_access deny CONNECT !SSL_ports rule. After editing, restart the ssrf_proxy container for changes to take effect. Without this, Squid will refuse connections to port 5011 even if the IP is allowed [source].

If you’ve already done this and still see the error, try running curl http://192.168.56.66:5011/read_customer_file/ from inside the ssrf_proxy container to check if the service is reachable from there. If not, the issue is likely with Docker networking or the service binding (it must listen on 0.0.0.0). Also, confirm that port 5011 is exposed in your docker-compose.yaml as 5011:5011 [source].

Finally, check the Squid logs in the ssrf_proxy container for denied or failed connection attempts—they’ll show exactly why the connection is refused.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other

Chat with Dosu Open in Cursor Join Discord Share on X

@dosubot[bot] commented on GitHub (Nov 26, 2025): <!-- Answer --> The ACL entry for `192.168.56.66` alone isn't enough—Squid also blocks CONNECT requests to ports not explicitly allowed. Make sure your `squid.conf.template` includes a line like `acl SSL_ports port 5011` (or add 5011 to an existing `SSL_ports` line), and that it's not commented out or overridden by a later rule. This line must appear before any `http_access deny CONNECT !SSL_ports` rule. After editing, restart the `ssrf_proxy` container for changes to take effect. Without this, Squid will refuse connections to port 5011 even if the IP is allowed [[source](https://github.com/langgenius/dify-official-plugins/issues/1690)]. If you’ve already done this and still see the error, try running `curl http://192.168.56.66:5011/read_customer_file/` from inside the `ssrf_proxy` container to check if the service is reachable from there. If not, the issue is likely with Docker networking or the service binding (it must listen on `0.0.0.0`). Also, confirm that port 5011 is exposed in your `docker-compose.yaml` as `5011:5011` [[source](https://github.com/langgenius/dify-official-plugins/issues/1816)]. Finally, check the Squid logs in the `ssrf_proxy` container for denied or failed connection attempts—they’ll show exactly why the connection is refused. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/a5b4e8f4-e31c-4339-ad47-51d682a95c4b?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/a5b4e8f4-e31c-4339-ad47-51d682a95c4b?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/a5b4e8f4-e31c-4339-ad47-51d682a95c4b?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/a5b4e8f4-e31c-4339-ad47-51d682a95c4b?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/a5b4e8f4-e31c-4339-ad47-51d682a95c4b?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/a5b4e8f4-e31c-4339-ad47-51d682a95c4b?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/a5b4e8f4-e31c-4339-ad47-51d682a95c4b?feedback_type=other)</sup> [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/6088a4f4-073a-43f3-b3d4-4f06fb0c05a0/ask?utm_source=github)&nbsp;[![Open in Cursor](https://dosu.dev/dosu-in-cursor.svg)](https://cursor.com/link/prompt?text=The%20ACL%20entry%20for%20%60192.168.56.66%60%20alone%20isn%27t%20enough%E2%80%94Squid%20also%20blocks%20CONNECT%20requests%20to%20ports%20not%20explicitly%20allowed.%20Make%20sure%20your%20%60squid.conf.template%60%20includes%20a%20line%20like%20%60acl%20SSL_ports%20port%205011%60%20%28or%20add%205011%20to%20an%20existing%20%60SSL_ports%60%20line%29%2C%20and%20that%20it%27s%20not%20commented%20out%20or%20overridden%20by%20a%20later%20rule.%20This%20line%20must%20appear%20before%20any%20%60http_access%20deny%20CONNECT%20%21SSL_ports%60%20rule.%20After%20editing%2C%20restart%20the%20%60ssrf_proxy%60%20container%20for%20changes%20to%20take%20effect.%20Without%20this%2C%20Squid%20will%20refuse%20connections%20to%20port%205011%20even%20if%20the%20IP%20is%20allowed%20%5B%5Bsource%5D%28https%3A//github.com/langgenius/dify-official-plugins/issues/1690%29%5D.%0A%0AIf%20you%E2%80%99ve%20already%20done%20this%20and%20still%20see%20the%20error%2C%20try%20running%20%60curl%20http%3A//192.168.56.66%3A5011/read_customer_file/%60%20from%20inside%20the%20%60ssrf_proxy%60%20container%20to%20check%20if%20the%20service%20is%20reachable%20from%20there.%20If%20not%2C%20the%20issue%20is%20likely%20with%20Docker%20networking%20or%20the%20service%20binding%20%28it%20must%20listen%20on%20%600.0.0.0%60%29.%20Also%2C%20confirm%20that%20port%205011%20is%20exposed%20in%20your%20%60docker-compose.yaml%60%20as%20%605011%3A5011%60%20%5B%5Bsource%5D%28https%3A//github.com/langgenius/dify-official-plugins/issues/1816%29%5D.%0A%0AFinally%2C%20check%20the%20Squid%20logs%20in%20the%20%60ssrf_proxy%60%20container%20for%20denied%20or%20failed%20connection%20attempts%E2%80%94they%E2%80%99ll%20show%20exactly%20why%20the%20connection%20is%20refused.)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/28691)
yindo commented 2026-02-21 20:07:59 -05:00
Author
Owner
Copy Link
Copy Source

@liaoduanyong commented on GitHub (Nov 26, 2025):

squid.conf.template deafult config is acl SSL_ports port 1025-65535, still need config acl SSL_ports port 5011?
5011 already in docker-compose.yaml as 5011:5011

@liaoduanyong commented on GitHub (Nov 26, 2025): squid.conf.template deafult config is acl SSL_ports port 1025-65535, still need config acl SSL_ports port 5011? 5011 already in docker-compose.yaml as 5011:5011
yindo commented 2026-02-21 20:07:59 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Nov 26, 2025):

If the line acl SSL_ports port 1025-65535 in your squid.conf.template is uncommented (not starting with #), then port 5011 is already allowed and you do not need to add acl SSL_ports port 5011 separately. However, by default this line is commented out, so you must either uncomment it or add acl SSL_ports port 5011 explicitly. Make sure this line appears before any http_access deny CONNECT !SSL_ports rule, then reload Squid in the ssrf_proxy container with squid -k reconfigure or restart the container for changes to take effect. This will allow CONNECT requests to port 5011 through the proxy reference reference.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other

Chat with Dosu Open in Cursor Join Discord Share on X

@dosubot[bot] commented on GitHub (Nov 26, 2025): <!-- Answer --> If the line `acl SSL_ports port 1025-65535` in your squid.conf.template is uncommented (not starting with `#`), then port 5011 is already allowed and you do not need to add `acl SSL_ports port 5011` separately. However, by default this line is commented out, so you must either uncomment it or add `acl SSL_ports port 5011` explicitly. Make sure this line appears before any `http_access deny CONNECT !SSL_ports` rule, then reload Squid in the ssrf_proxy container with `squid -k reconfigure` or restart the container for changes to take effect. This will allow CONNECT requests to port 5011 through the proxy [reference](https://github.com/langgenius/dify/blob/ef0e1031b04f167e93344d848273b96b8daac64d/docker/ssrf_proxy/squid.conf.template) [reference](https://github.com/langgenius/dify/issues/14621#issuecomment-2692332556). <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/98d02071-5446-4109-a319-173f7ccd4731?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/98d02071-5446-4109-a319-173f7ccd4731?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/98d02071-5446-4109-a319-173f7ccd4731?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/98d02071-5446-4109-a319-173f7ccd4731?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/98d02071-5446-4109-a319-173f7ccd4731?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/98d02071-5446-4109-a319-173f7ccd4731?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/98d02071-5446-4109-a319-173f7ccd4731?feedback_type=other)</sup> [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/6088a4f4-073a-43f3-b3d4-4f06fb0c05a0/ask?utm_source=github)&nbsp;[![Open in Cursor](https://dosu.dev/dosu-in-cursor.svg)](https://cursor.com/link/prompt?text=If%20the%20line%20%60acl%20SSL_ports%20port%201025-65535%60%20in%20your%20squid.conf.template%20is%20uncommented%20%28not%20starting%20with%20%60%23%60%29%2C%20then%20port%205011%20is%20already%20allowed%20and%20you%20do%20not%20need%20to%20add%20%60acl%20SSL_ports%20port%205011%60%20separately.%20However%2C%20by%20default%20this%20line%20is%20commented%20out%2C%20so%20you%20must%20either%20uncomment%20it%20or%20add%20%60acl%20SSL_ports%20port%205011%60%20explicitly.%20Make%20sure%20this%20line%20appears%20before%20any%20%60http_access%20deny%20CONNECT%20%21SSL_ports%60%20rule%2C%20then%20reload%20Squid%20in%20the%20ssrf_proxy%20container%20with%20%60squid%20-k%20reconfigure%60%20or%20restart%20the%20container%20for%20changes%20to%20take%20effect.%20This%20will%20allow%20CONNECT%20requests%20to%20port%205011%20through%20the%20proxy%C2%A0%5Breference%5D%28https%3A//github.com/langgenius/dify/blob/ef0e1031b04f167e93344d848273b96b8daac64d/docker/ssrf_proxy/squid.conf.template%29%C2%A0%5Breference%5D%28https%3A//github.com/langgenius/dify/issues/14621%23issuecomment-2692332556%29.)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/28691)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Knowledge Pipeline
Proposal
WIP
cloud
dependencies
feat:webapp
good first issue
outdated
performance
pull-request
Mirrored from GitHub Pull Request
 python:uv
refactor
size:L
stale
status: accepting prs
status: blocked
status: in discussion
stt & tts
vulnerablity
web
wont-fix
🌊 feat:workflow
🌚 invalid
🐞 bug
👻 feat:rag
💪 enhancement
📚 documentation
🔨 feat:tools
🙋‍♂️ question
🙏 help wanted
🤔 cant-reproduce
🤖 feat:agent
No Label 🐞 bug 🤔 cant-reproduce
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#20566
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?