# Internal URL no longer oneboxing **URL:** \ **Category:** Support\ **Created:** [2017年六月9日 05:17 UTC](https://meta.discourse.org/t/internal-url-no-longer-oneboxing/64208 "2017-06-09T05:17:04Z")\ **Posts on this page:** 8\ **Page:** 2
**Author:** ![eviltrout](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/eviltrout/32/5275_2.png) [@eviltrout](https://meta.discourse.org/u/eviltrout)\ **Post date:** [2017年六月9日 15:54 UTC](https://meta.discourse.org/t/internal-url-no-longer-oneboxing/64208/21 "2017-06-09T15:54:47Z")
The issue here is if `forums.mydomain.com` resolves to something internal like `192.168.0.1` internally then you are doing requests on the internal network and not the external one. so someone could start poking around your network. If you trust your users I could possibly add a site setting to disable this extra security, but as you’ve seen it doesn’t happen on our hosting because resolving `meta.discourse.org` internally brings up the external IP address, not the internal network address. ---
**Author:** ![Richard\_Greaves](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/richard_greaves/32/120944_2.png) [@Richard\_Greaves](https://meta.discourse.org/u/Richard_Greaves)\ **Post date:** [2017年六月9日 16:01 UTC](https://meta.discourse.org/t/internal-url-no-longer-oneboxing/64208/22 "2017-06-09T16:01:46Z")
Hey all, I’m IT for Josh, so the instance is running in containers, on the container host and inside the container the IP resolves to the external IP (The Load Balancer Public IP {ELB}) same as the clients. ---
**Author:** ![jomaxro](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jomaxro/32/126216_2.png) [@jomaxro](https://meta.discourse.org/u/jomaxro)\ **Post date:** [2017年六月12日 15:49 UTC](https://meta.discourse.org/t/internal-url-no-longer-oneboxing/64208/23 "2017-06-12T15:49:26Z")
@eviltrout, based on the information you have so far, would this new setting potentially fix the problem? > [@Cross referencing a post doesn't create onebox](https://meta.discourse.org/t/cross-referencing-a-post-doesnt-create-onebox/64327/10): > > You have to be patient - jeff only suggested a setting 16 hours ago. I will get it done today. (No rush, just asking 😃) ---
**Author:** ![eviltrout](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/eviltrout/32/5275_2.png) [@eviltrout](https://meta.discourse.org/u/eviltrout)\ **Post date:** [2017年六月12日 15:53 UTC](https://meta.discourse.org/t/internal-url-no-longer-oneboxing/64208/24 "2017-06-12T15:53:47Z")
The setting will bypass this security check. However your IT person above said IPs should be resolving to public values so I’m not sure why it would be failing in your case. You can try out later today and report back though. ---
**Author:** ![eviltrout](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/eviltrout/32/5275_2.png) [@eviltrout](https://meta.discourse.org/u/eviltrout)\ **Post date:** [2017年六月12日 17:23 UTC](https://meta.discourse.org/t/internal-url-no-longer-oneboxing/64208/25 "2017-06-12T17:23:57Z")
Before I add a whitelist setting, one thing I realized is I should just whitelist the current host the site is on. If you are oneboxing the same discourse it should ignore those networking rules now: [https://github.com/discourse/discourse/commit/a3729b51ebc9958904f15e5105754380de723997](https://github.com/discourse/discourse/commit/a3729b51ebc9958904f15e5105754380de723997) ---
**Author:** ![jomaxro](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jomaxro/32/126216_2.png) [@jomaxro](https://meta.discourse.org/u/jomaxro)\ **Post date:** [2017年六月12日 17:27 UTC](https://meta.discourse.org/t/internal-url-no-longer-oneboxing/64208/26 "2017-06-12T17:27:49Z")
That certainly makes sense, thanks @eviltrout! I’ll pull the update once it hits `tests_paseed`. ---
**Author:** ![jomaxro](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jomaxro/32/126216_2.png) [@jomaxro](https://meta.discourse.org/u/jomaxro)\ **Post date:** [2017年六月12日 19:19 UTC](https://meta.discourse.org/t/internal-url-no-longer-oneboxing/64208/27 "2017-06-12T19:19:12Z")
Can confirm this works, thanks @eviltrout! Feel free to lock this up 🔒 ---
**Author:** ![eviltrout](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/eviltrout/32/5275_2.png) [@eviltrout](https://meta.discourse.org/u/eviltrout)\ **Post date:** [2017年六月12日 19:29 UTC](https://meta.discourse.org/t/internal-url-no-longer-oneboxing/64208/28 "2017-06-12T19:29:40Z")
[上一頁](https://meta.discourse.org/t/internal-url-no-longer-oneboxing/64208.md?page=1)