Access Denied after upgrade to SABnzbd 3.3.0

Get help with all aspects of SABnzbd
Forum rules
Help us help you:
  • Are you using the latest stable version of SABnzbd? Downloads page.
  • Tell us what system you run SABnzbd on.
  • Adhere to the forum rules.
  • Do you experience problems during downloading?
    Check your connection in Status and Interface settings window.
    Use Test Server in Config > Servers.
    We will probably ask you to do a test using only basic settings.
  • Do you experience problems during repair or unpacking?
    Enable +Debug logging in the Status and Interface settings window and share the relevant parts of the log here using [ code ] sections.
Post Reply
bhavicp
Newbie
Newbie
Posts: 2
Joined: June 1st, 2021, 10:29 am

Access Denied after upgrade to SABnzbd 3.3.0

Post by bhavicp »

Hello,

Today I upgraded my SABnzbd from 3.2.X (or maybe 3.1.X) to 3.3 - And trying to access it externally in the browser, I'm simply getting an "Access denied", first I thought this was the access whitelist, but accessing via the IP is also giving the same issue. And the DNS name is added to the whitelist (and it was working)

In the logs all the I can see is:

Code: Select all

2021-06-01 16:26:50,322::INFO::[notifier:122] Sending notification: Warning - Refused connection from: X.X.X.X [Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36] (type=warning, job_cat=None)
2021-06-01 16:26:50,322::WARNING::[interface:376] Refused connection from: X.X.X.X [Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36]
Would anyone have any ideas why? I had a look through the .ini but couldn't see anything obvious. And just to mention again this was working before the upgrade, so maybe it's a new feature or default setting?

Thanks,
User avatar
sander
Release Testers
Release Testers
Posts: 8812
Joined: January 22nd, 2008, 2:22 pm

Re: Access Denied after upgrade

Post by sander »

is your SABnzbd running on a VPS, or another device with a public IPv4 address?
stark
Newbie
Newbie
Posts: 2
Joined: June 1st, 2021, 1:50 pm

Re: Access Denied after upgrade

Post by stark »

I'm getting the same error running a virtual Server 2019 install. 3.2 was working fine 3.3 can't access from other PC's on the LAN. This is running on an ESXi server.

Refused connection from: xxx.xxx.xxx.xxx [Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0]

Everything else works as normal have done a test download with no issues.

Tried turning off https auth and get the same error and my downloads history is gone. Renable https and history is back.

All these devices are inside my firewall and all traffic goes through the firewall and as I said downloads work if I just add something from Sonarr for example. Seems to be just the web interface
User avatar
sander
Release Testers
Release Testers
Posts: 8812
Joined: January 22nd, 2008, 2:22 pm

Re: Access Denied after upgrade

Post by sander »

stark wrote: June 1st, 2021, 1:55 pm I'm getting the same error running a virtual Server 2019 install. 3.2 was working fine 3.3 can't access from other PC's on the LAN. This is running on an ESXi server.
At http://127.0.0.1:8080/config/general/#inet_exposure ... what does SAB say? If "No Access", change to "Full Web Interface", Save, and access from another PC.

If that works, the explanation is: to add more security, we now restrict access to devices from the LAN ... which we define as "same subnet". However, within a Virtual Server, you might have a different IP address / subnet than the devices on the LAN ....


For reference / Google / duckduckgo, here's the full message:

Code: Select all

2021-06-01 21:29:07,639::WARNING::[interface:376] Refused connection from: 1.1.162.65 [Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36]
And for CLI heros: SABnzbd now has a command line parameter option for this:

Code: Select all

--inet_exposure <0..5>  Set external internet access [*]


Furthermore, the entry in sabnzbd.ini is inet_exposure, and full access is with:

Code: Select all

inet_exposure = 4
HTH
bhavicp
Newbie
Newbie
Posts: 2
Joined: June 1st, 2021, 10:29 am

Re: Access Denied after upgrade

Post by bhavicp »

sander wrote: June 1st, 2021, 11:53 am is your SABnzbd running on a VPS, or another device with a public IPv4 address?
Sorry yes I should have mentioned, it's running inside a docker container.


Changed inet_exposure = 3 to inet_exposure = 4 as per your suggestion and it works now.

Thanks
stark
Newbie
Newbie
Posts: 2
Joined: June 1st, 2021, 1:50 pm

Re: Access Denied after upgrade

Post by stark »

That got it working.

All on the same subnet don't have that many devices just yet! I was making the assumption that External internet access mean from outside my LAN which I didn't want.

Thanks.
User avatar
sander
Release Testers
Release Testers
Posts: 8812
Joined: January 22nd, 2008, 2:22 pm

Re: Access Denied after upgrade to SABnzbd 3.3.0

Post by sander »

... weird: a default lsio docker container is just accessible from LAN with setting "API - No Access"

docker run -p 18080:8080 ghcr.io/linuxserver/sabnzbd

So more feedback / experience welcome
User avatar
safihre
Administrator
Administrator
Posts: 5338
Joined: April 30th, 2015, 7:35 am
Contact:

Re: Access Denied after upgrade to SABnzbd 3.3.0

Post by safihre »

You can still define your own network ranges through the Special setting local_ranges.
If you like our support, check our special newsserver deal or donate at: https://sabnzbd.org/donate
User avatar
jcfp
Release Testers
Release Testers
Posts: 986
Joined: February 7th, 2008, 12:45 pm

Re: Access Denied after upgrade to SABnzbd 3.3.0

Post by jcfp »

sander wrote: June 1st, 2021, 2:22 pm[...] to add more security, we now restrict access to devices from the LAN ... which we define as "same subnet". However, within a Virtual Server, you might have a different IP address / subnet than the devices on the LAN ....
sander wrote: June 1st, 2021, 2:54 pm... weird: a default lsio docker container is just accessible from LAN with setting "API - No Access"
By default (i.e., with no custom local ranges defined) all LAN address ranges are allowed, see interface.check_access(). Access is not limited to a specific subnet unless a user configures the local_ranges setting to that effect.
User avatar
sander
Release Testers
Release Testers
Posts: 8812
Joined: January 22nd, 2008, 2:22 pm

Re: Access Denied after upgrade to SABnzbd 3.3.0

Post by sander »

jcfp wrote: June 1st, 2021, 6:07 pm
sander wrote: June 1st, 2021, 2:22 pm[...] to add more security, we now restrict access to devices from the LAN ... which we define as "same subnet". However, within a Virtual Server, you might have a different IP address / subnet than the devices on the LAN ....
sander wrote: June 1st, 2021, 2:54 pm... weird: a default lsio docker container is just accessible from LAN with setting "API - No Access"
By default (i.e., with no custom local ranges defined) all LAN address ranges are allowed, see interface.check_access(). Access is not limited to a specific subnet unless a user configures the local_ranges setting to that effect.
Ah, thanks for clarification

Code: Select all

>>> from sabnzbd import misc
>>> misc.is_lan_addr('172.17.0.3')
True

So I guess OPs must have configured local ranges.
Kankle
Newbie
Newbie
Posts: 1
Joined: June 2nd, 2021, 2:39 pm

Re: Access Denied after upgrade to SABnzbd 3.3.0

Post by Kankle »

Edit: I got everything working again by changing inet_exposure = 0 to 4 as recommended by sander above. This restored all external access again.

Thank you!

So I'm confused on how to fix this. I updated to 3.3.0 and now have no access to SAB from outside the computer it is installed on. This is a hardware Windows server 2019. I'm not running any VM. Windows firewall is disabled, and same ports have been forwarded on router for years. When I rolled back to previous version, all my external connections work again.

What do I need to do to get 3.3.0 to work with external connections again?

Thank you,
guitarboy
Jr. Member
Jr. Member
Posts: 69
Joined: January 7th, 2010, 2:44 am

Re: Access Denied after upgrade to SABnzbd 3.3.0

Post by guitarboy »

I was also getting the "Refused connection" error when trying to send NZBs from an indexer. I'm not sure what the "Config -> General -> External internet access" setting was before the 3.3 upgrade, but it was set to "No access". I changed it to "Add NZB files" and that fixed the problem. The issue is documented here.
Post Reply