Thanks for your explain. I found the ultimate solution for my situation.
My situation: I am using WSL (assigned 192.168.1.2 in the virtual LAN) to run Discourse, and it is configured to connect remote servers through the proxy running on Windows (assigned 192.168.1.1).
When Discourse wants to connect a remote server by a hostname, SSRF will try system DNS set in /etc/resolv.conf, however, in default, Windows’ vLAN IP address (mine is 192.168.1.1) is WSL’s only DNS server. But subnet 192.168.0.0/16 has been blacklisted by SSRFDetector, it can not even acquire DNS answer. (I just skimmed its code, so I do not know whether the opinion above is correct)
By adding 192.168.1.1 into config item Allowed internal hosts, everything continues to work. Umm, maybe Discourse should not blacklist hostname in env var HTTP_PROXY and HTTPS_PROXY?