Browser network access
Understand why a page can load halfway, and let the browser reach a local development target when you really need it.
What the proxy allows
Every browser request passes through a proxy that checks and pins the destination address. Only HTTP and HTTPS are allowed, and a URL with embedded credentials is rejected.
The proxy blocks localhost, private and link-local addresses, cloud metadata addresses, and the ports commonly used by remote login, mail relays, databases, search and caches. This is the default and needs no setup.
Always-blocked ports
Ports 22, 25, 111, 135, 137–139, 445, 2375–2376, 3306, 5432, 6379, 9200 and 11211 are always blocked. A private network allowlist entry does not open them.
Allow a local target
Admin: Only an administrator can change this, and it applies to the whole instance.
- Open Settings → Plugins → browser.
- Find Private network allowlist and add an exact hostname or a CIDR range.
- Save. Chetty restarts to load the change.
- Ask the agent to open the address again. The proxy still checks and pins each resolved address.
Warning: Keep the list empty unless you need a local target. An entry permits browser access to a destination that is otherwise blocked, and it does not open private destinations to Site captures.
What a refusal looks like
A blocked request can appear in Chrome as a failed tunnel or a missing image rather than a clear message. The proxy records the reason in the daemon log, at most once per reason per minute for each account.
Connection and request-rate limits can look the same. If pages load partly after a while, compare the totals with the limits in Proxy limits.