SABnzbd Forums

Posted: **June 1st, 2021, 10:33 am**

Hello,

Today I upgraded my SABnzbd from 3.2.X (or maybe 3.1.X) to 3.3 - And trying to access it externally in the browser, I'm simply getting an "Access denied", first I thought this was the access whitelist, but accessing via the IP is also giving the same issue. And the DNS name is added to the whitelist (and it was working)

In the logs all the I can see is:

Code: Select all

2021-06-01 16:26:50,322::INFO::[notifier:122] Sending notification: Warning - Refused connection from: X.X.X.X [Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36] (type=warning, job_cat=None)
2021-06-01 16:26:50,322::WARNING::[interface:376] Refused connection from: X.X.X.X [Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36]

Would anyone have any ideas why? I had a look through the .ini but couldn't see anything obvious. And just to mention again this was working before the upgrade, so maybe it's a new feature or default setting?

Thanks,

Posted: **June 1st, 2021, 11:53 am**

is your SABnzbd running on a VPS, or another device with a public IPv4 address?

Posted: **June 1st, 2021, 1:55 pm**

I'm getting the same error running a virtual Server 2019 install. 3.2 was working fine 3.3 can't access from other PC's on the LAN. This is running on an ESXi server.

Refused connection from: xxx.xxx.xxx.xxx [Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0]

Everything else works as normal have done a test download with no issues.

Tried turning off https auth and get the same error and my downloads history is gone. Renable https and history is back.

All these devices are inside my firewall and all traffic goes through the firewall and as I said downloads work if I just add something from Sonarr for example. Seems to be just the web interface

Posted: **June 1st, 2021, 2:22 pm**

stark wrote: ↑June 1st, 2021, 1:55 pm I'm getting the same error running a virtual Server 2019 install. 3.2 was working fine 3.3 can't access from other PC's on the LAN. This is running on an ESXi server.

At http://127.0.0.1:8080/config/general/#inet_exposure ... what does SAB say? If "No Access", change to "Full Web Interface", Save, and access from another PC.

If that works, the explanation is: to add more security, we now restrict access to devices from the LAN ... which we define as "same subnet". However, within a Virtual Server, you might have a different IP address / subnet than the devices on the LAN ....

For reference / Google / duckduckgo, here's the full message:

Code: Select all

2021-06-01 21:29:07,639::WARNING::[interface:376] Refused connection from: 1.1.162.65 [Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36]

And for CLI heros: SABnzbd now has a command line parameter option for this:

Code: Select all

--inet_exposure <0..5>  Set external internet access [*]

Furthermore, the entry in sabnzbd.ini is inet_exposure, and full access is with:

Code: Select all

inet_exposure = 4

HTH

Posted: **June 1st, 2021, 2:32 pm**

sander wrote: ↑June 1st, 2021, 11:53 am is your SABnzbd running on a VPS, or another device with a public IPv4 address?

Sorry yes I should have mentioned, it's running inside a docker container.

Changed inet_exposure = 3 to inet_exposure = 4 as per your suggestion and it works now.

Thanks

Posted: **June 1st, 2021, 2:52 pm**

That got it working.

All on the same subnet don't have that many devices just yet! I was making the assumption that External internet access mean from outside my LAN which I didn't want.

Thanks.

Posted: **June 1st, 2021, 2:54 pm**

... weird: a default lsio docker container is just accessible from LAN with setting "API - No Access"

docker run -p 18080:8080 ghcr.io/linuxserver/sabnzbd

So more feedback / experience welcome

Posted: **June 1st, 2021, 3:47 pm**

You can still define your own network ranges through the Special setting local_ranges.

Posted: **June 1st, 2021, 6:07 pm**

sander wrote: ↑June 1st, 2021, 2:22 pm[...] to add more security, we now restrict access to devices from the LAN ... which we define as "same subnet". However, within a Virtual Server, you might have a different IP address / subnet than the devices on the LAN ....

sander wrote: ↑June 1st, 2021, 2:54 pm... weird: a default lsio docker container is just accessible from LAN with setting "API - No Access"

By default (i.e., with no custom local ranges defined) all LAN address ranges are allowed, see interface.check_access(). Access is not limited to a specific subnet unless a user configures the local_ranges setting to that effect.

Posted: **June 2nd, 2021, 1:19 am**

jcfp wrote: ↑June 1st, 2021, 6:07 pm
sander wrote: ↑June 1st, 2021, 2:22 pm[...] to add more security, we now restrict access to devices from the LAN ... which we define as "same subnet". However, within a Virtual Server, you might have a different IP address / subnet than the devices on the LAN ....
sander wrote: ↑June 1st, 2021, 2:54 pm... weird: a default lsio docker container is just accessible from LAN with setting "API - No Access"
By default (i.e., with no custom local ranges defined) all LAN address ranges are allowed, see interface.check_access(). Access is not limited to a specific subnet unless a user configures the local_ranges setting to that effect.

Ah, thanks for clarification

Code: Select all

>>> from sabnzbd import misc
>>> misc.is_lan_addr('172.17.0.3')
True

So I guess OPs must have configured local ranges.

Posted: **June 2nd, 2021, 2:45 pm**

Edit: I got everything working again by changing inet_exposure = 0 to 4 as recommended by sander above. This restored all external access again.

Thank you!

So I'm confused on how to fix this. I updated to 3.3.0 and now have no access to SAB from outside the computer it is installed on. This is a hardware Windows server 2019. I'm not running any VM. Windows firewall is disabled, and same ports have been forwarded on router for years. When I rolled back to previous version, all my external connections work again.

What do I need to do to get 3.3.0 to work with external connections again?

Thank you,

Posted: **July 3rd, 2021, 7:19 pm**

I was also getting the "Refused connection" error when trying to send NZBs from an indexer. I'm not sure what the "Config -> General -> External internet access" setting was before the 3.3 upgrade, but it was set to "No access". I changed it to "Add NZB files" and that fixed the problem. The issue is documented here.

SABnzbd Forums

Access Denied after upgrade to SABnzbd 3.3.0

Access Denied after upgrade to SABnzbd 3.3.0

Re: Access Denied after upgrade

Re: Access Denied after upgrade

Re: Access Denied after upgrade

Re: Access Denied after upgrade

Re: Access Denied after upgrade

Re: Access Denied after upgrade to SABnzbd 3.3.0

Re: Access Denied after upgrade to SABnzbd 3.3.0

Re: Access Denied after upgrade to SABnzbd 3.3.0

Re: Access Denied after upgrade to SABnzbd 3.3.0

Re: Access Denied after upgrade to SABnzbd 3.3.0

Re: Access Denied after upgrade to SABnzbd 3.3.0