Crowdsec block access (403), can't whitelist IP #1641

New Issue

MrUnknownDE · 2026-04-05T19:38:03+02:00

MrUnknownDE commented

2026-04-05 19:38:03 +02:00

Originally created by @aszurnasirpal on 4/5/2025

Hi,

I tried many ways to bypass that, but I failed miserably.

in docker compose I mounted volume under crowdsec section

      - ./config/whitelists.yaml:/etc/crowdsec/parsers/s02-enrich/whitelists.yaml

then I edited ./config/whitelists.yaml, where I put my IP address

  ip:
    - "::1"
    - "95.88.xxx.xxx"

but still, while in crowdsec logs I see that IP is banned

time="2025-04-05T08:05:47Z" level=info msg="172.18.0.4 - [Sat, 05 Apr 2025 08:05:47 UTC] \"GET /v1/decisions?ip=95.88.xxx.xxx&banned=true HTTP/1.1 403 828.986µs \"Crowdsec-Bouncer-Traefik-Plugin/1.X.X\" \""

Additional info:

/ # cscli decisions list
No active decisions

/ # cscli alerts list
No active alerts

Does anyone else have any idea how to bypass that?

Update:
Tried to add exclusions via pangolin docker bot

----------------------------------------------
 Allowlist: white                             
----------------------------------------------
 Name                white                    
 Description         whitelists_pangolin      
 Created at          2025-04-05T08:21:04.621Z 
 Updated at          2025-04-05T08:21:31.137Z 
 Managed by Console  no                       
----------------------------------------------

-------------------------------------------------------------
 Value         Comment  Expiration  Created at               
-------------------------------------------------------------
 95.88.xx.xxx           never       2025-04-05T08:21:04.621Z 
-------------------------------------------------------------

Still effect is the same

*Originally created by @aszurnasirpal on 4/5/2025* Hi, I tried many ways to bypass that, but I failed miserably. in docker compose I mounted volume under crowdsec section ``` - ./config/whitelists.yaml:/etc/crowdsec/parsers/s02-enrich/whitelists.yaml ``` then I edited ./config/whitelists.yaml, where I put my IP address ``` ip: - "::1" - "95.88.xxx.xxx" ``` but still, while in crowdsec logs I see that IP is banned ``` time="2025-04-05T08:05:47Z" level=info msg="172.18.0.4 - [Sat, 05 Apr 2025 08:05:47 UTC] \"GET /v1/decisions?ip=95.88.xxx.xxx&banned=true HTTP/1.1 403 828.986µs \"Crowdsec-Bouncer-Traefik-Plugin/1.X.X\" \"" ``` Additional info: ``` / # cscli decisions list No active decisions ``` ``` / # cscli alerts list No active alerts ``` Does anyone else have any idea how to bypass that? Update: Tried to add exclusions via pangolin docker bot ``` ---------------------------------------------- Allowlist: white ---------------------------------------------- Name white Description whitelists_pangolin Created at 2025-04-05T08:21:04.621Z Updated at 2025-04-05T08:21:31.137Z Managed by Console no ---------------------------------------------- ------------------------------------------------------------- Value Comment Expiration Created at ------------------------------------------------------------- 95.88.xx.xxx never 2025-04-05T08:21:04.621Z ------------------------------------------------------------- ``` Still effect is the same

MrUnknownDE closed this issue

2026-04-05 19:38:03 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#1641