LocalNetworkAccess

Configure local network access (LNA) security features. The LocalNetworkAccess policy controls Firefox's behavior when websites attempt to access local network resources (localhost and local network addresses).

Without these checks, websites can send requests to devices such as routers, printers, or IoT devices on the user's network. This can be dangerous because some devices assume that requests originating from the local network are trusted, which can enable attacks such as cross-site request forgery. Local network access protections require permission before a website can make requests to local or loopback addresses, where applicable.

Compatibility

Firefox	Firefox ESR	Firefox Enterprise
Available since 145	Available since 153	Available since 149

CCK2 Equivalent: N/A
Preferences Affected: network.lna.enabled, network.lna.block_trackers, network.lna.blocking, network.lna.skip-domains

Examples

policies.json

{
  "policies": {
    "LocalNetworkAccess": {
      "Enabled": true,
      "BlockTrackers": true,
      "EnablePrompting": true,
      "SkipDomains": [
        "example.org",
        "*.example.com"
      ],
      "Locked": true
    }
  }
}

JSON schema

LocalNetworkAccess JSON schema

{
  "type": "object",
  "properties": {
    "Enabled": {
      "type": "boolean"
    },
    "BlockTrackers": {
      "type": "boolean"
    },
    "EnablePrompting": {
      "type": "boolean"
    },
    "SkipDomains": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "Locked": {
      "type": "boolean"
    }
  }
}

Values

• Enabled: a Boolean that enables or disables the policy.
  • When true (default), Firefox enforces local network access security checks. This is the base flag without which none of the local network access checks below would be enforced.
  • When false, all local network access checks are disabled and websites can freely access local network resources.
• BlockTrackers: a Boolean that controls blocking third-party trackers. When true, third-party trackers are directly blocked from accessing localhost and local network resources. This is an experimental feature that helps prevent tracking scripts from scanning your local network.
• EnablePrompting: a Boolean to gate user permission prompts. When true, access to local network resources will be explicitly gated via user permission prompts. Users will be asked to grant permission before a website can access local resources.
• SkipDomains: an array of domain names for which local network access checks should be skipped. This allows administrators to create exceptions for trusted domains.
• Locked: if set to true, users cannot change any local network access settings set by the policy.

Note

BlockTrackers and EnablePrompting only apply when Enabled is explicitly set to true, and both default to true if they are not defined. Firefox does not block trackers from LNA by default, and setting Enabled to true on its own also turns LNA tracker blocking on.

Setting Enabled to false turns both permission prompting and blocking third-party trackers off. SkipDomains is applied independently, whether or not Enabled is defined.

Description

When providing a list of exceptions for trusted domains, the SkipDomains array can contain both source domains (the website making the request) and target domains (the local resource being accessed).

When a source domain is listed, that website is allowed to access local network resources without restrictions. For example, if "trusted-app.example.com" is listed, that website can freely make requests to any local network resources.

When a target domain is listed, any website can access that specific local network resource without restrictions. For example, if "printer.local" is listed, all websites can access the printer device.

Suffix wildcard patterns are supported using the *. prefix to match all subdomains:

• "*.company.com" - Skips checks for company.com and all subdomains (matching company.com, app.company.com, portal.company.com, etc.).
• "*.internal" - Skips checks for all .internal domains (matching internal, device.internal, printer.internal, etc.).
• "web-app.example.com" - Skips checks for this specific domain only (no subdomain matching).
• "*.devices.local" - Allows access to all local devices with .devices.local suffix (matching printer.devices.local, scanner.devices.local, etc.).
• "*.corp.internal" - Allows access to all corporate internal domains.

A *. prefix pattern includes the domain itself, so you do not need a separate entry for it. This means "*.microsoft.com" matches microsoft.com as well as login.microsoft.com. An entry without the *. prefix matches the host only, so "microsoft.com" will not match login.microsoft.com.

Windows (GPO)

Software\Policies\Mozilla\Firefox\LocalNetworkAccess\Enabled = 0x1 | 0x0
Software\Policies\Mozilla\Firefox\LocalNetworkAccess\BlockTrackers = 0x1 | 0x0
Software\Policies\Mozilla\Firefox\LocalNetworkAccess\EnablePrompting = 0x1 | 0x0
Software\Policies\Mozilla\Firefox\LocalNetworkAccess\SkipDomains\1 = "intranet.company.com"
Software\Policies\Mozilla\Firefox\LocalNetworkAccess\SkipDomains\2 = "*.devices.local"
Software\Policies\Mozilla\Firefox\LocalNetworkAccess\SkipDomains\3 = "*.corp.internal"
Software\Policies\Mozilla\Firefox\LocalNetworkAccess\Locked = 0x1 | 0x0

Windows (Intune)

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~LocalNetworkAccess/LocalNetworkAccess_Enabled

Value (string):

<enabled/> or <disabled/>

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~LocalNetworkAccess/LocalNetworkAccess_BlockTrackers

Value (string):

<enabled/> or <disabled/>

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~LocalNetworkAccess/LocalNetworkAccess_EnablePrompting

Value (string):

<enabled/> or <disabled/>

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~LocalNetworkAccess/LocalNetworkAccess_SkipDomains

Value (string):

<enabled/>
<data id="LocalNetworkAccess_SkipDomains" value="1&#xF000;intranet.company.com&#xF000;2&#xF000;*.devices.local&#xF000;3&#xF000;*.corp.internal"/>

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~LocalNetworkAccess/LocalNetworkAccess_Locked

Value (string):

<enabled/> or <disabled/>

macOS

<dict>
  <key>LocalNetworkAccess</key>
  <dict>
    <key>Enabled</key>
    <true/> | <false/>
    <key>BlockTrackers</key>
    <true/> | <false/>
    <key>EnablePrompting</key>
    <true/> | <false/>
    <key>SkipDomains</key>
    <array>
      <string>intranet.company.com</string>
      <string>*.devices.local</string>
      <string>admin-portal.enterprise.com</string>
      <string>*.corp.internal</string>
    </array>
    <key>Locked</key>
    <true/> | <false/>
  </dict>
</dict>

See also

• Local network access on MDN
• Local Network Access specification in the W3C Web Incubator Community Group