Access Denied after upgrade to SABnzbd 3.3.0

[bhavicp]

Hello,

Today I upgraded my SABnzbd from 3.2.X (or maybe 3.1.X) to 3.3 - And trying to access it externally in the browser, I'm simply getting an "Access denied", first I thought this was the access whitelist, but accessing via the IP is also giving the same issue. And the DNS name is added to the whitelist (and it was working)

In the logs all the I can see is:

Code: Select all

2021-06-01 16:26:50,322::INFO::[notifier:122] Sending notification: Warning - Refused connection from: X.X.X.X [Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36] (type=warning, job_cat=None)
2021-06-01 16:26:50,322::WARNING::[interface:376] Refused connection from: X.X.X.X [Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36]

Would anyone have any ideas why? I had a look through the .ini but couldn't see anything obvious. And just to mention again this was working before the upgrade, so maybe it's a new feature or default setting?

Thanks,

[sander]

is your SABnzbd running on a VPS, or another device with a public IPv4 address?

[stark]

I'm getting the same error running a virtual Server 2019 install. 3.2 was working fine 3.3 can't access from other PC's on the LAN. This is running on an ESXi server.

Refused connection from: xxx.xxx.xxx.xxx [Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0]

Everything else works as normal have done a test download with no issues.

Tried turning off https auth and get the same error and my downloads history is gone. Renable https and history is back.

All these devices are inside my firewall and all traffic goes through the firewall and as I said downloads work if I just add something from Sonarr for example. Seems to be just the web interface

[sander]

I'm getting the same error running a virtual Server 2019 install. 3.2 was working fine 3.3 can't access from other PC's on the LAN. This is running on an ESXi server.

At http://127.0.0.1:8080/config/general/#inet_exposure ... what does SAB say? If "No Access", change to "Full Web Interface", Save, and access from another PC.

If that works, the explanation is: to add more security, we now restrict access to devices from the LAN ... which we define as "same subnet". However, within a Virtual Server, you might have a different IP address / subnet than the devices on the LAN ....


For reference / Google / duckduckgo, here's the full message:

Code: Select all

2021-06-01 21:29:07,639::WARNING::[interface:376] Refused connection from: 1.1.162.65 [Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36]

And for CLI heros: SABnzbd now has a command line parameter option for this:

Code: Select all

--inet_exposure <0..5>  Set external internet access [*]

Furthermore, the entry in sabnzbd.ini is inet_exposure, and full access is with:

Code: Select all

inet_exposure = 4

HTH

[bhavicp]

is your SABnzbd running on a VPS, or another device with a public IPv4 address?

Sorry yes I should have mentioned, it's running inside a docker container.


Changed inet_exposure = 3 to inet_exposure = 4 as per your suggestion and it works now.

Thanks

[stark]

That got it working.

All on the same subnet don't have that many devices just yet! I was making the assumption that External internet access mean from outside my LAN which I didn't want.

Thanks.

[sander]

... weird: a default lsio docker container is just accessible from LAN with setting "API - No Access"

docker run -p 18080:8080 ghcr.io/linuxserver/sabnzbd

So more feedback / experience welcome

[safihre]

You can still define your own network ranges through the Special setting local_ranges.

[jcfp]

[...] to add more security, we now restrict access to devices from the LAN ... which we define as "same subnet". However, within a Virtual Server, you might have a different IP address / subnet than the devices on the LAN ....

... weird: a default lsio docker container is just accessible from LAN with setting "API - No Access"

By default (i.e., with no custom local ranges defined) all LAN address ranges are allowed, see interface.check_access(). Access is not limited to a specific subnet unless a user configures the local_ranges setting to that effect.

[sander]

[...] to add more security, we now restrict access to devices from the LAN ... which we define as "same subnet". However, within a Virtual Server, you might have a different IP address / subnet than the devices on the LAN ....

... weird: a default lsio docker container is just accessible from LAN with setting "API - No Access"

By default (i.e., with no custom local ranges defined) all LAN address ranges are allowed, see interface.check_access(). Access is not limited to a specific subnet unless a user configures the local_ranges setting to that effect.

Ah, thanks for clarification

Code: Select all

>>> from sabnzbd import misc
>>> misc.is_lan_addr('172.17.0.3')
True

So I guess OPs must have configured local ranges.

[Kankle]

Edit: I got everything working again by changing inet_exposure = 0 to 4 as recommended by sander above. This restored all external access again.

Thank you!

So I'm confused on how to fix this. I updated to 3.3.0 and now have no access to SAB from outside the computer it is installed on. This is a hardware Windows server 2019. I'm not running any VM. Windows firewall is disabled, and same ports have been forwarded on router for years. When I rolled back to previous version, all my external connections work again.

What do I need to do to get 3.3.0 to work with external connections again?

Thank you,

[guitarboy]

I was also getting the "Refused connection" error when trying to send NZBs from an indexer. I'm not sure what the "Config -> General -> External internet access" setting was before the 3.3 upgrade, but it was set to "No access". I changed it to "Add NZB files" and that fixed the problem. The issue is documented here.