client

var SecureDialer = &net.Dialer{
	Control: func(network, address string, c syscall.RawConn) error {
		host, _, err := net.SplitHostPort(address)
		if err != nil {
			return err
		}
		ip, err := netip.ParseAddr(host)
		if err != nil || !isPublicIP(ip) {
			return fmt.Errorf("blocked address %s", host)
		}
		return nil
	},
	Timeout:   5 * time.Second,
	KeepAlive: 30 * time.Second,
}

SecureDialer is a net.Dialer that performs some additional checks of an address before performing connection logic. It will ensure that the address is actually a public address. This also covers redirects, since every connection the client makes goes through the hook. Note that if you use a proxy, the dial goes to the proxy, so the check won't apply to the final destination.