Context: #9417 (comment)

The Synapse config option url_preview_ip_range_blacklist is intended to restrict access to previewing certain URLs based on their resolved IP address. However, when using a proxy with Synapse (via the HTTP_PROXY and HTTPS_PROXY environment variables), url preview requests are forwarded to the proxy, which then resolves the IP address of the URL. This completely bypasses any IP ranges set in the url_preview_ip_range_blacklist option.

Ideally we'd do a couple things that would help reduce confusion for sysadmins:

• We should document in the sample config file that the value of url_preview_ip_range_blacklist is ignored when using an HTTP proxy, as resolving URLs to preview is done by the proxy.
• Currently it is required to set url_preview_ip_range_blacklist if URL previews are enabled. We shouldn't require url_preview_ip_range_blacklist to be set when using a proxy, and we should log a warning when url_preview_ip_range_blacklist is set and a proxy is in use so that the sysadmin isn't under the wrong impression regarding security of the system.

To be clear, if you're using a proxy for URL previews, you should do your ip blacklisting in the proxy config. Also note that url_preview_url_blacklist is still enforced whether a proxy is in use or not.