LocalNetworkAccess

Configure local network access (LNA) security features. The LocalNetworkAccess policy controls Firefox's behavior when websites attempt to access local network resources (localhost and local network addresses).

Without these checks, websites can send requests to devices such as routers, printers, or IoT devices on the user's network. This can be dangerous because some devices assume that requests originating from the local network are trusted, which can enable attacks such as cross-site request forgery. Local network access protections require permission before a website can make requests to local or loopback addresses, where applicable.

Values

• Enabled: a Boolean that enables or disables the policy.
  • When true (default), Firefox enforces local network access security checks. This is the base flag without which none of the local network access checks below would be enforced.
  • When false, all local network access checks are disabled and websites can freely access local network resources.
• BlockTrackers: a Boolean that controls blocking third-party trackers. When true, third-party trackers are directly blocked from accessing localhost and local network resources. This is an experimental feature that helps prevent tracking scripts from scanning your local network.
• EnablePrompting: a Boolean to gate user permission prompts. When true, access to local network resources will be explicitly gated via user permission prompts. Users will be asked to grant permission before a website can access local resources.
• SkipDomains: an array of domain names for which local network access checks should be skipped. This allows administrators to create exceptions for trusted domains.
• Locked: if set to true, users cannot change any local network access settings set by the policy.

Note

BlockTrackers and EnablePrompting only apply when Enabled is explicitly set to true, and both default to true if they are not defined. Firefox does not block trackers from LNA by default, and setting Enabled to true on its own also turns LNA tracker blocking on.

Setting Enabled to false turns both permission prompting and blocking third-party trackers off. SkipDomains is applied independently, whether or not Enabled is defined.

Examples

policies.json

{
  "policies": {
    "LocalNetworkAccess": {
      "Enabled": true,
      "BlockTrackers": true,
      "EnablePrompting": true,
      "SkipDomains": [
        "example.org",
        "*.example.com"
      ],
      "Locked": true
    }
  }
}

JSON schema

LocalNetworkAccess JSON schema

{
  "type": "object",
  "properties": {
    "Enabled": {
      "type": "boolean"
    },
    "BlockTrackers": {
      "type": "boolean"
    },
    "EnablePrompting": {
      "type": "boolean"
    },
    "SkipDomains": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "Locked": {
      "type": "boolean"
    }
  }
}

Allowing requests from a trusted site

This example adds intranet.example.com to the SkipDomains list and sets Locked to true, so users can't change the exception list. When a web app on intranet.example.com requests access to a local network resource, Firefox matches the requesting site against SkipDomains and allows the request without a local network access permission prompt:

{
  "policies": {
    "LocalNetworkAccess": {
      "SkipDomains": ["intranet.example.com"],
      "Locked": true
    }
  }
}

Allowing requests to trusted devices

This example adds *.devices.internal to the SkipDomains list, which lets any website reach devices such as printer.devices.internal without permission prompts. The *. prefix matches devices.internal and all of its subdomains:

{
  "policies": {
    "LocalNetworkAccess": {
      "SkipDomains": ["*.devices.internal"]
    }
  }
}

Description

When providing a list of exceptions for trusted domains, the SkipDomains array can contain both source domains (the website making the request) and target domains (the local resource being accessed). Firefox checks every entry against both the requesting website and the local resource, so an entry can match either way.

When a website requests access to a local network resource, Firefox checks the source domain against SkipDomains. If it matches, Firefox skips the local network access permission prompt. For example, listing "trusted-app.example.com" skips these prompts for requests from that website to any local network resource.

Additionally, Firefox checks the target domain against SkipDomains. If it matches, Firefox skips the prompt regardless of which website made the request. For example, listing "printer.local" skips these prompts for requests from any website to that device.

Suffix wildcard patterns are supported using the *. prefix to match all subdomains:

• "*.company.com" - Skips checks for company.com and all subdomains (matching company.com, app.company.com, portal.company.com, etc.).
• "*.internal" - Skips checks for all .internal domains (matching internal, device.internal, printer.internal, etc.).
• "web-app.example.com" - Skips checks for this specific domain only (no subdomain matching).
• "*.devices.local" - Allows access to all local devices with .devices.local suffix (matching printer.devices.local, scanner.devices.local, etc.).
• "*.corp.internal" - Allows access to all corporate internal domains.

A *. prefix pattern includes the domain itself, so you do not need a separate entry for it. This means "*.microsoft.com" matches microsoft.com as well as login.microsoft.com. An entry without the *. prefix matches the host only, so "microsoft.com" will not match login.microsoft.com.

Windows (GPO)

Software\Policies\Mozilla\Firefox\LocalNetworkAccess\Enabled = 0x1 | 0x0
Software\Policies\Mozilla\Firefox\LocalNetworkAccess\BlockTrackers = 0x1 | 0x0
Software\Policies\Mozilla\Firefox\LocalNetworkAccess\EnablePrompting = 0x1 | 0x0
Software\Policies\Mozilla\Firefox\LocalNetworkAccess\SkipDomains\1 = "intranet.company.com"
Software\Policies\Mozilla\Firefox\LocalNetworkAccess\SkipDomains\2 = "*.devices.local"
Software\Policies\Mozilla\Firefox\LocalNetworkAccess\SkipDomains\3 = "*.corp.internal"
Software\Policies\Mozilla\Firefox\LocalNetworkAccess\Locked = 0x1 | 0x0

macOS

<dict>
  <key>LocalNetworkAccess</key>
  <dict>
    <key>Enabled</key>
    <true/> | <false/>
    <key>BlockTrackers</key>
    <true/> | <false/>
    <key>EnablePrompting</key>
    <true/> | <false/>
    <key>SkipDomains</key>
    <array>
      <string>intranet.company.com</string>
      <string>*.devices.local</string>
      <string>admin-portal.enterprise.com</string>
      <string>*.corp.internal</string>
    </array>
    <key>Locked</key>
    <true/> | <false/>
  </dict>
</dict>

Compatibility

Firefox	Firefox ESR	Firefox Enterprise
Available since 145145	Available since 153153	Available since 149149

CCK2 Equivalent: N/A
OMA-URI: LocalNetworkAccess
Preferences Affected: network.lna.enabled, network.lna.block_trackers, network.lna.blocking, network.lna.skip-domains

See also

• Local network access on MDN
• Local Network Access specification in the W3C Web Incubator Community Group