Dolibarr/dolibarr · error

Access refused by IP protection. Your detected IP is

Error message

Access refused by IP protection. Your detected IP is: ${user_ip}

What it means

Dolibarr's optional IP whitelist (MAINrestrictips / restricted IPs list) compares the client IP against an authorized list; if no entry matches, it prints this message and exits before loading anything else. The detected IP is escaped and shown to help diagnose proxy/NAT issues.

Solutions

1. Add the printed detected IP to the authorized IP list in setup (Security > IP restrictions) or conf
2. Configure Dolibarr to trust X-Forwarded-For (e.g. MAIN_PROXYADDRS/反向 proxy settings) so the real client IP is compared
3. Disable the IP restriction if it is no longer needed
4. For IPv6, whitelist the correct prefix/addresses

$ips = explode(';', getDolGlobalString('MAIN_SECURITY_ALLOWEDEXTERNALIPS','')); if (!in_array($_SERVER['REMOTE_ADDR'], $ips)) { error_log('IP not whitelisted: '.$_SERVER['REMOTE_ADDR']); }

When it happens

Trigger: IP restriction enabled with an authorized IP list; incoming $user_ip (REMOTE_ADDR, possibly X-Forwarded-For derived) is not in the list — every comparison loop fails so $found stays false.

Common situations: Office IP changed / dynamic ISP IP rotated; accessing via a reverse proxy so REMOTE_ADDR is the proxy IP; IPv6 address used while list only contains IPv4; VPN or load balancer in path.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• Sorry, your application is offline.
• You are logged with user
• Sorry, your application is offline. Only administrator users
• If you access your server behind a proxy using url…
• Bad link. File is from another module part.

AI-assisted analysis of Dolibarr/dolibarr@598aa4bdad (2026-09-14). Data as JSON: /api/errors/058990d0119e61de. Report an issue: GitHub.

Appendix: source

Thrown at htdocs/main.inc.php:296

if (!defined('NOLOGIN') && !defined('NOIPCHECK') && !empty($dolibarr_main_restrict_ip)) {
	$listofip = explode(',', $dolibarr_main_restrict_ip);
	$found = false;
	$user_ip = $_SERVER['REMOTE_ADDR'];
	foreach ($listofip as $ip) {
		$authorized_ip = trim($ip);
		if (strpos($authorized_ip, '/')) { // Check if IP with CIDR notation
			if (checkIPInCidr($user_ip, $authorized_ip) > 0) {
				$found = true;
				break;
			}
		} elseif ($user_ip == $authorized_ip) {
			$found = true;
			break;
		}
	}
	if (!$found) {
		print 'Access refused by IP protection. Your detected IP is: '.dol_escape_htmltag($user_ip);
		exit;
	}
}

// Loading of additional presentation includes
if (!defined('NOREQUIREHTML')) {
	require_once DOL_DOCUMENT_ROOT.'/core/class/html.form.class.php'; // Need 660ko memory (800ko in 2.2)
}
if (!defined('NOREQUIREAJAX')) {
	require_once DOL_DOCUMENT_ROOT.'/core/lib/ajax.lib.php'; // Need 22ko memory
}

// If install or upgrade process not done or not completely finished, we call the install page.
if (getDolGlobalString('MAIN_NOT_INSTALLED') || getDolGlobalString('MAIN_NOT_UPGRADED')) {
	dol_syslog("main.inc: A previous install or upgrade was not complete. Redirect to install page.", LOG_WARNING);
	header("Location: ".DOL_URL_ROOT."/install/index.php");
	exit;
}

View on GitHub (pinned to 598aa4bdad)