Claude Code cannot establish TCP connections to local network hosts — No route to host (while iTerm2 succeeds)

Bug Report

When running commands from Claude Code (VSCode extension), TCP connections to a local network host fail with "No route to host" (errno 65). The exact same commands succeed when run from iTerm2 on the same machine, same user, same network interface.

Environment

• macOS (Apple Silicon, M1 Mac mini, 16GB)
• VSCode with Claude Code extension v2.1.101
• Target: Raspberry Pi on same LAN (192.168.10.17, port 54444)

Reproduction

1. From iTerm2: ssh -p 54444 yuichi@192.168.10.17 → succeeds
2. From Claude Code Bash tool: ssh -p 54444 yuichi@192.168.10.17 → "No route to host"
3. From Claude Code Python: socket.connect(('192.168.10.17', 54444)) → errno 65
4. From Claude Code: traceroute 192.168.10.17 → succeeds (reaches host in 0.6ms)
5. From Claude Code: ping 192.168.10.17 → "No route to host"
6. From Claude Code: nc -z -w 5 192.168.10.17 54444 → fails
7. From iTerm2: nc -z -w 5 192.168.10.17 54444 → succeeds

Investigation performed by Claude Code itself

Claude Code attempted to diagnose this issue autonomously and checked all of the following — none explained the discrepancy:

• ARP: Resolves correctly (MAC address e4:5f:1:58:f1:25 visible on en0)
• Routing table: Correct entry for 192.168.10.17 via en0
• macOS Application Firewall: Disabled (socketfilterfw --getglobalstate → State = 0)
• pf firewall: No active rules (pfctl -sr returns empty)
• Process entitlements: No sandbox or network restrictions on the Claude binary or Code Helper (Plugin)
• Proxy settings: None configured (system or VSCode level)
• Network interface: Same en0 (192.168.10.6/24), same subnet
• User/permissions: Same user (immr), same groups
• Tailscale Network Extension: Installed and active, but disabling it (tailscale down) did not resolve the issue
• macOS update: Persists after OS update

Process tree

VSCode (PID 1234)
  → Code Helper (Plugin) (PID 1446)
    → claude native binary (PID 1599)
      → /bin/zsh (PID $$) ← commands executed here

Key observation

traceroute succeeds (L3 reachability confirmed) but all TCP/UDP connections fail. This suggests filtering at the transport layer that is specific to the process tree originating from VSCode/Claude Code.

Expected behavior

Claude Code's Bash tool should have the same network access as any other terminal emulator running on the same machine under the same user.

Workaround

SSH to the Raspberry Pi via iTerm2 and paste commands from Claude Code manually.

---

Feature Request: Networking knowledge for infrastructure tasks

Claude Code is increasingly used for infrastructure management — SSH tunneling, firewall configuration, network diagnostics, multi-machine orchestration. During this investigation, Claude Code was unable to identify the root cause despite extensive debugging.

Suggestion: Strengthen the model's practical networking knowledge, particularly:

• TCP/IP layer-by-layer diagnostics (L2/L3/L4 isolation)
• OS-specific networking stacks (macOS Network Extensions, pf, Windows Firewall/WFP, Linux iptables/nftables)
• ARP, routing table analysis, DNS fundamentals
• Practical interpretation of diagnostic tools (traceroute, ping, netstat, ss, tcpdump)

This would significantly improve Claude Code's usefulness for system administration tasks across diverse environments.