download.opensuse.org will redirect you to close mirror. it will normally *not* serve the files itself. so if you only allow download.opensuse.org but nothing else. this will fail of course.