{"record":{"id":"058990d0119e61de","repo":"Dolibarr/dolibarr","slug":"access-refused-by-ip-protection-your-detected-ip-is-user-ip","errorCode":null,"errorMessage":"Access refused by IP protection. Your detected IP is: ${user_ip}","messagePattern":"Access refused by IP protection\\. Your detected IP is: (.+?)","errorType":"http","errorClass":null,"httpStatus":403,"severity":"error","filePath":"htdocs/main.inc.php","lineNumber":296,"sourceCode":"\nif (!defined('NOLOGIN') && !defined('NOIPCHECK') && !empty($dolibarr_main_restrict_ip)) {\n\t$listofip = explode(',', $dolibarr_main_restrict_ip);\n\t$found = false;\n\t$user_ip = $_SERVER['REMOTE_ADDR'];\n\tforeach ($listofip as $ip) {\n\t\t$authorized_ip = trim($ip);\n\t\tif (strpos($authorized_ip, '/')) { // Check if IP with CIDR notation\n\t\t\tif (checkIPInCidr($user_ip, $authorized_ip) > 0) {\n\t\t\t\t$found = true;\n\t\t\t\tbreak;\n\t\t\t}\n\t\t} elseif ($user_ip == $authorized_ip) {\n\t\t\t$found = true;\n\t\t\tbreak;\n\t\t}\n\t}\n\tif (!$found) {\n\t\tprint 'Access refused by IP protection. Your detected IP is: '.dol_escape_htmltag($user_ip);\n\t\texit;\n\t}\n}\n\n// Loading of additional presentation includes\nif (!defined('NOREQUIREHTML')) {\n\trequire_once DOL_DOCUMENT_ROOT.'/core/class/html.form.class.php'; // Need 660ko memory (800ko in 2.2)\n}\nif (!defined('NOREQUIREAJAX')) {\n\trequire_once DOL_DOCUMENT_ROOT.'/core/lib/ajax.lib.php'; // Need 22ko memory\n}\n\n// If install or upgrade process not done or not completely finished, we call the install page.\nif (getDolGlobalString('MAIN_NOT_INSTALLED') || getDolGlobalString('MAIN_NOT_UPGRADED')) {\n\tdol_syslog(\"main.inc: A previous install or upgrade was not complete. Redirect to install page.\", LOG_WARNING);\n\theader(\"Location: \".DOL_URL_ROOT.\"/install/index.php\");\n\texit;\n}","sourceCodeStart":278,"sourceCodeEnd":314,"githubUrl":"https://github.com/Dolibarr/dolibarr/blob/598aa4bdada683d17ca04b1842548821ff0eb6c6/htdocs/main.inc.php#L278-L314","documentation":"Dolibarr's optional IP whitelist (MAINrestrictips / restricted IPs list) compares the client IP against an authorized list; if no entry matches, it prints this message and exits before loading anything else. The detected IP is escaped and shown to help diagnose proxy/NAT issues.","triggerScenarios":"IP restriction enabled with an authorized IP list; incoming $user_ip (REMOTE_ADDR, possibly X-Forwarded-For derived) is not in the list — every comparison loop fails so $found stays false.","commonSituations":"Office IP changed / dynamic ISP IP rotated; accessing via a reverse proxy so REMOTE_ADDR is the proxy IP; IPv6 address used while list only contains IPv4; VPN or load balancer in path.","solutions":["Add the printed detected IP to the authorized IP list in setup (Security > IP restrictions) or conf","Configure Dolibarr to trust X-Forwarded-For (e.g. MAIN_PROXYADDRS/反向 proxy settings) so the real client IP is compared","Disable the IP restriction if it is no longer needed","For IPv6, whitelist the correct prefix/addresses"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"$ips = explode(';', getDolGlobalString('MAIN_SECURITY_ALLOWEDEXTERNALIPS','')); if (!in_array($_SERVER['REMOTE_ADDR'], $ips)) { error_log('IP not whitelisted: '.$_SERVER['REMOTE_ADDR']); }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Whitelist proxy IPs or enable trusted X-Forwarded-For handling behind reverse proxies","Keep the authorized IP list updated when office/VPN IPs change","Include both IPv4 and IPv6 addresses","Verify with 'what is my IP' from the affected network before enabling restrictions"],"tags":["dolibarr","ip-restriction","access-control","proxy"],"backgroundTag":"permission-denied","analyzedSha":"598aa4bdada683d17ca04b1842548821ff0eb6c6","analyzedAt":"2026-09-14T11:12:15.309Z","contentChangedAt":"2026-09-14T11:12:15.309Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}