{"record":{"id":"f4ce4d970ac9c166","repo":"crowdsecurity/crowdsec","slug":"ip-not-in-allowed-range-for-auto-registration","errorCode":null,"errorMessage":"IP not in allowed range for auto registration","messagePattern":"IP not in allowed range for auto registration","errorType":"http","errorClass":null,"httpStatus":403,"severity":"error","filePath":"pkg/apiserver/controllers/v1/machines.go","lineNumber":45,"sourceCode":"\t}\n\n\tif token == \"\" {\n\t\treturn false, nil\n\t}\n\n\t// Check the token\n\tif token != c.AutoRegisterCfg.Token {\n\t\treturn false, errors.New(\"invalid token for auto registration\")\n\t}\n\n\t// Check the source IP\n\tfor _, ipRange := range c.AutoRegisterCfg.AllowedRangesParsed {\n\t\tif ipRange.Contains(clientIP) {\n\t\t\treturn true, nil\n\t\t}\n\t}\n\n\treturn false, errors.New(\"IP not in allowed range for auto registration\")\n}\n\nfunc (c *Controller) CreateMachine(gctx *gin.Context) {\n\tctx := gctx.Request.Context()\n\n\tvar input models.WatcherRegistrationRequest\n\n\tif err := gctx.ShouldBindJSON(&input); err != nil {\n\t\tgctx.JSON(http.StatusBadRequest, gin.H{\"message\": err.Error()})\n\t\treturn\n\t}\n\n\tif err := input.Validate(strfmt.Default); err != nil {\n\t\tgctx.JSON(http.StatusUnprocessableEntity, gin.H{\"message\": err.Error()})\n\t\treturn\n\t}\n\n\tautoRegister, err := c.shouldAutoRegister(input.RegistrationToken, gctx)","sourceCodeStart":27,"sourceCodeEnd":63,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/apiserver/controllers/v1/machines.go#L27-L63","documentation":"After the token check passes, shouldAutoRegister verifies the client IP belongs to one of api.server.auto_register.allowed_ranges. A valid token from an IP outside those CIDR ranges is rejected with this error to prevent arbitrary hosts from self-enrolling.","triggerScenarios":"A watcher registers with the correct auto-register token, but its source IP is not inside any configured allowed_ranges CIDR (e.g. enrolling through a NAT/proxy, Docker network, or IPv6 address while only IPv4 ranges are configured).","commonSituations":"Machine reached the LAPI via a load balancer so the source IP differs; containers on a bridge network using 172.x not covered by ranges; missing ::/0 range for IPv6 clients; ranges left at defaults after network re-architecture.","solutions":["Add the client's subnet to api.server.auto_register.allowed_ranges in the LAPI config and restart crowdsec.","Add ::/0 (or the specific IPv6 range) if clients connect over IPv6.","Check whether a proxy rewrites source IPs; trust/forward the real client IP or widen ranges to the proxy network."],"exampleFix":"# before\nauto_register:\n  token: xxx\n  allowed_ranges:\n    - 192.168.0.0/16\n# after\nauto_register:\n  token: xxx\n  allowed_ranges:\n    - 192.168.0.0/16\n    - 172.16.0.0/12\n    - ::/0","handlingStrategy":"validation","validationCode":"ip := net.ParseIP(clientIP)\nfor _, cidr := range allowedRanges {\n    if cidr.Contains(ip) { ok = true; break }\n}\nif !ok { return errors.New(\"client IP outside auto_register allowed_ranges\") }","typeGuard":null,"tryCatchPattern":"_, err := client.Register(ctx, url, token)\nif err != nil && strings.Contains(err.Error(), \"not in allowed range\") {\n    log.Error(\"ask the LAPI admin to add your subnet to auto_register.allowed_ranges\")\n}","preventionTips":["Configure allowed_ranges to cover every network path clients use (NAT, Docker, VPN, IPv6).","Confirm the source IP seen by the LAPI with logs before registering.","Document the enrollment network requirements for operators."],"tags":["authentication","lapi","ip-range"],"backgroundTag":"permission-denied","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}