{"record":{"id":"3409225fa42ff2bd","repo":"netbirdio/netbird","slug":"invalid-user-host-format","errorCode":null,"errorMessage":"invalid user@host format","messagePattern":"invalid user@host format","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"client/cmd/ssh.go","lineNumber":497,"sourceCode":"\t\tlogLevel = flags.LogLevel\n\t}\n\n\tlocalForwards = localForwardFlags\n\tremoteForwards = remoteForwardFlags\n\n\treturn parseHostnameAndCommand(remaining)\n}\n\nfunc parseHostnameAndCommand(args []string) error {\n\tif len(args) < 1 {\n\t\treturn errors.New(hostArgumentRequired)\n\t}\n\n\targ := args[0]\n\tif strings.Contains(arg, \"@\") {\n\t\tparts := strings.SplitN(arg, \"@\", 2)\n\t\tif len(parts) != 2 || parts[0] == \"\" || parts[1] == \"\" {\n\t\t\treturn errors.New(\"invalid user@host format\")\n\t\t}\n\t\tif username == \"\" {\n\t\t\tusername = parts[0]\n\t\t}\n\t\thost = parts[1]\n\t} else {\n\t\thost = arg\n\t}\n\n\tif username == \"\" {\n\t\tif sudoUser := os.Getenv(\"SUDO_USER\"); sudoUser != \"\" {\n\t\t\tusername = sudoUser\n\t\t} else if currentUser, err := user.Current(); err == nil {\n\t\t\tusername = currentUser.Username\n\t\t} else {\n\t\t\tusername = \"root\"\n\t\t}\n\t}","sourceCodeStart":479,"sourceCodeEnd":515,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/cmd/ssh.go#L479-L515","documentation":"The main IP-restriction deny in checkIPRestrictions (proxy/internal/auth/middleware.go:261). After resolving the client IP, the filter produces a restrict.Verdict: over the NetBird overlay (types.IsOverlayOrigin) only CheckCIDR applies, otherwise Check also runs Geo/CrowdSec. Verdicts other than Allow that are not in observe-only mode end here — blockIPRestriction records the reason, then the client gets 403.","triggerScenarios":"Client IP outside the allowed CIDR ranges for the domain; Geo verdict from a disallowed country when geo policy is attached; CrowdSec verdict while the restriction is in enforce (not observe) mode; overlay-origin request from a tunnel IP not in the permitted NetBird ranges.","commonSituations":"Corporate allow-list missing the contractor's new subnet; geo-restriction blocking a travelling user; CrowdSec escalated from observe to enforce and started blocking previously-warned IPs; service shared with a partner whose overlay range was never added.","solutions":["Read the reason passed to blockIPRestriction (verdict.String() is logged/recorded) to learn which rule fired: CIDR, geo, or CrowdSec.","Add the client's effective IP or range to the service's allowed ranges — remember the effective IP comes from CapturedData (X-Forwarded-For honored only for trusted proxies), not necessarily the TCP peer.","For CrowdSec, keep the restriction in observe mode while onboarding so verdicts are only logged until the ranges are proven.","For geo blocks, either add the country to the allow set or disable geo filtering for that domain."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Caller-side pre-check: verify the effective egress IP is inside the\n// service's allowed ranges before sending real traffic.\nfunc allowed(myIP netip.Addr, ranges []netip.Prefix) bool {\n    for _, p := range ranges {\n        if p.Contains(myIP) {\n            return true\n        }\n    }\n    return false\n}","typeGuard":null,"tryCatchPattern":"resp, err := client.Get(url)\nif err == nil && resp.StatusCode == http.StatusForbidden {\n    // Distinguish restriction blocks from private-service blocks: restrictions\n    // log a verdict (cidr/geo/crowdsec) server-side; check which rule matches\n    // your effective IP (X-Forwarded-For aware), fix the range, retry.\n}","preventionTips":["Track which effective IP the proxy sees for you (trusted XFF is honored), not just your local address.","Keep CrowdSec-backed restrictions in observe mode until ranges are validated.","Maintain the allow-list as part of onboarding for new offices/contractors.","For overlay-origin traffic, remember only CIDR rules apply — add the NetBird ranges."],"tags":["proxy","ip-restrictions","geo","crowdsec","authorization"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}