crowdsecurity/crowdsec · error

IP not in allowed range for auto registration

Error message

IP not in allowed range for auto registration

What it means

After the token check passes, shouldAutoRegister verifies the client IP belongs to one of api.server.auto_register.allowed_ranges. A valid token from an IP outside those CIDR ranges is rejected with this error to prevent arbitrary hosts from self-enrolling.

Source

Thrown at pkg/apiserver/controllers/v1/machines.go:45

	}

	if token == "" {
		return false, nil
	}

	// Check the token
	if token != c.AutoRegisterCfg.Token {
		return false, errors.New("invalid token for auto registration")
	}

	// Check the source IP
	for _, ipRange := range c.AutoRegisterCfg.AllowedRangesParsed {
		if ipRange.Contains(clientIP) {
			return true, nil
		}
	}

	return false, errors.New("IP not in allowed range for auto registration")
}

func (c *Controller) CreateMachine(gctx *gin.Context) {
	ctx := gctx.Request.Context()

	var input models.WatcherRegistrationRequest

	if err := gctx.ShouldBindJSON(&input); err != nil {
		gctx.JSON(http.StatusBadRequest, gin.H{"message": err.Error()})
		return
	}

	if err := input.Validate(strfmt.Default); err != nil {
		gctx.JSON(http.StatusUnprocessableEntity, gin.H{"message": err.Error()})
		return
	}

	autoRegister, err := c.shouldAutoRegister(input.RegistrationToken, gctx)

View on GitHub (pinned to 909b515798)

Solutions

1. Add the client's subnet to api.server.auto_register.allowed_ranges in the LAPI config and restart crowdsec.
2. Add ::/0 (or the specific IPv6 range) if clients connect over IPv6.
3. Check whether a proxy rewrites source IPs; trust/forward the real client IP or widen ranges to the proxy network.

Example fix

# before
auto_register:
  token: xxx
  allowed_ranges:
    - 192.168.0.0/16
# after
auto_register:
  token: xxx
  allowed_ranges:
    - 192.168.0.0/16
    - 172.16.0.0/12
    - ::/0

ip := net.ParseIP(clientIP)
for _, cidr := range allowedRanges {
    if cidr.Contains(ip) { ok = true; break }
}
if !ok { return errors.New("client IP outside auto_register allowed_ranges") }

_, err := client.Register(ctx, url, token)
if err != nil && strings.Contains(err.Error(), "not in allowed range") {
    log.Error("ask the LAPI admin to add your subnet to auto_register.allowed_ranges")
}

When it happens

Trigger: A watcher registers with the correct auto-register token, but its source IP is not inside any configured allowed_ranges CIDR (e.g. enrolling through a NAT/proxy, Docker network, or IPv6 address while only IPv4 ranges are configured).

Common situations: Machine reached the LAPI via a load balancer so the source IP differs; containers on a bridge network using 172.x not covered by ranges; missing ::/0 range for IPv6 clients; ranges left at defaults after network re-architecture.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• invalid token for auto registration
• bouncer not found
• failed to extract claims
• tls authentication required
• authenticate watcher (%s): %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/f4ce4d970ac9c166. Report an issue: GitHub.