403 Access Denied on Fresh Installation #1695

New Issue

MrUnknownDE · 2026-04-05T19:39:42+02:00

MrUnknownDE commented

2026-04-05 19:39:42 +02:00

Originally created by @leopck on 3/21/2025

I followed the guide to install, mostly just setting up my DNS to point to my A record IP address on my server, I'm using CloudFlare's DNS but I turned off Proxy so it's just Proxying DNS only so no CloudFlare redirection.

My installation steps are:

sudo ./installer.sh
# Fill up all the questions
docker compose up -d

Then I tried to access via my domain name xyz.com and I got 403 Unauthorized. Also, all the docker logs are not showing any errors :(

traefik logs:

{"level":"info","version":"3.3.3","time":"2025-03-21T11:49:35Z","message":"Traefik version 3.3.3 built on 2025-01-31T14:55:01Z"}
{"level":"info","time":"2025-03-21T11:49:35Z","message":"\nStats collection is disabled.\nHelp us improve Traefik by turning this feature on :)\nMore details on: https://doc.traefik.io/traefik/contributing/data-collection/\n"}
{"level":"info","plugins":["crowdsec","badger"],"time":"2025-03-21T11:49:35Z","message":"Loading plugins..."}
{"level":"info","plugins":["crowdsec","badger"],"time":"2025-03-21T11:49:36Z","message":"Plugins loaded."}
{"level":"info","time":"2025-03-21T11:49:36Z","message":"Starting provider aggregator *aggregator.ProviderAggregator"}
{"level":"info","time":"2025-03-21T11:49:36Z","message":"Starting provider *file.Provider"}
{"level":"info","time":"2025-03-21T11:49:36Z","message":"Starting provider *traefik.Provider"}
{"level":"info","time":"2025-03-21T11:49:36Z","message":"Starting provider *http.Provider"}
{"level":"info","time":"2025-03-21T11:49:36Z","message":"Starting provider *acme.ChallengeTLSALPN"}
{"level":"info","time":"2025-03-21T11:49:36Z","message":"Starting provider *acme.Provider"}
{"level":"info","providerName":"letsencrypt.acme","acmeCA":"https://acme-v02.api.letsencrypt.org/directory","time":"2025-03-21T11:49:36Z","message":"Testing certificate renew..."}
{"level":"info","providerName":"letsencrypt.acme","time":"2025-03-21T11:49:44Z","message":"Register..."}
{"level":"warn","time":"2025-03-21T11:59:36Z","message":"A new release of Traefik has been found: 3.3.4. Please consider updating."}

gerbil logs:

INFO: 2025/03/21 11:49:28 Fetching remote config from http://pangolin:3001/api/v1/gerbil/get-config
INFO: 2025/03/21 11:49:34 Created WireGuard interface wg0
INFO: 2025/03/21 11:49:34 Assigned IP address xx.xx.xx.xx/24 to interface wg0
INFO: 2025/03/21 11:49:34 Attempting to delete existing MSS clamping rule for chain INPUT
INFO: 2025/03/21 11:49:34 Attempting to delete existing MSS clamping rule for chain OUTPUT
INFO: 2025/03/21 11:49:34 Attempting to delete existing MSS clamping rule for chain FORWARD
INFO: 2025/03/21 11:49:34 Adding MSS clamping rule for chain INPUT
INFO: 2025/03/21 11:49:34 Successfully added and verified MSS clamping rule for chain INPUT
INFO: 2025/03/21 11:49:34 Adding MSS clamping rule for chain OUTPUT
INFO: 2025/03/21 11:49:34 Successfully added and verified MSS clamping rule for chain OUTPUT
INFO: 2025/03/21 11:49:34 Adding MSS clamping rule for chain FORWARD
INFO: 2025/03/21 11:49:34 Successfully added and verified MSS clamping rule for chain FORWARD
INFO: 2025/03/21 11:49:34 WireGuard interface wg0 created and configured
INFO: 2025/03/21 11:49:34 Starting server on :3003

pangolin logs:

> @fosrl/pangolin@0.0.0 start
> NODE_OPTIONS=--enable-source-maps NODE_ENV=development ENVIRONMENT=prod sh -c 'node dist/migrations.mjs && node dist/server.mjs'

Running migrations...
Migrations completed successfully.
2025-03-21T11:49:23.823Z [info]: Server admin (<email>) created
2025-03-21T11:49:26.233Z [info]: API server is running on http://localhost:3000
2025-03-21T11:49:26.288Z [info]: Internal server is running on http://localhost:3001
2025-03-21T11:49:27.094Z [info]: Next.js server is running on http://localhost:3002
2025-03-21T11:49:33.697Z [info]: Created new exit node Exit Node ja/R09vR with address xx.xx.xx.xx/24 and port 51820

Crowdsec logs:


time="2025-03-21T12:24:40Z" level=info msg="127.0.0.1 - [Fri, 21 Mar 2025 12:24:40 UTC] \"GET /v1/allowlists?with_content=true HTTP/1.1 200 3.459685ms \"crowdsec/v1.6.6-416eb27f-docker\" \""
time="2025-03-21T12:25:40Z" level=info msg="127.0.0.1 - [Fri, 21 Mar 2025 12:25:40 UTC] \"GET /v1/heartbeat HTTP/1.1 200 5.426621ms \"crowdsec/v1.6.6-416eb27f-docker\" \""
time="2025-03-21T12:25:40Z" level=info msg="127.0.0.1 - [Fri, 21 Mar 2025 12:25:40 UTC] \"GET /v1/allowlists?with_content=true HTTP/1.1 200 1.376711ms \"crowdsec/v1.6.6-416eb27f-docker\" \""

*Originally created by @leopck on 3/21/2025* I followed the guide to install, mostly just setting up my DNS to point to my A record IP address on my server, I'm using CloudFlare's DNS but I turned off Proxy so it's just Proxying DNS only so no CloudFlare redirection. My installation steps are: ```sh sudo ./installer.sh # Fill up all the questions docker compose up -d ``` Then I tried to access via my domain name `xyz.com` and I got 403 Unauthorized. Also, all the docker logs are not showing any errors :( traefik logs: ``` {"level":"info","version":"3.3.3","time":"2025-03-21T11:49:35Z","message":"Traefik version 3.3.3 built on 2025-01-31T14:55:01Z"} {"level":"info","time":"2025-03-21T11:49:35Z","message":"\nStats collection is disabled.\nHelp us improve Traefik by turning this feature on :)\nMore details on: https://doc.traefik.io/traefik/contributing/data-collection/\n"} {"level":"info","plugins":["crowdsec","badger"],"time":"2025-03-21T11:49:35Z","message":"Loading plugins..."} {"level":"info","plugins":["crowdsec","badger"],"time":"2025-03-21T11:49:36Z","message":"Plugins loaded."} {"level":"info","time":"2025-03-21T11:49:36Z","message":"Starting provider aggregator *aggregator.ProviderAggregator"} {"level":"info","time":"2025-03-21T11:49:36Z","message":"Starting provider *file.Provider"} {"level":"info","time":"2025-03-21T11:49:36Z","message":"Starting provider *traefik.Provider"} {"level":"info","time":"2025-03-21T11:49:36Z","message":"Starting provider *http.Provider"} {"level":"info","time":"2025-03-21T11:49:36Z","message":"Starting provider *acme.ChallengeTLSALPN"} {"level":"info","time":"2025-03-21T11:49:36Z","message":"Starting provider *acme.Provider"} {"level":"info","providerName":"letsencrypt.acme","acmeCA":"https://acme-v02.api.letsencrypt.org/directory","time":"2025-03-21T11:49:36Z","message":"Testing certificate renew..."} {"level":"info","providerName":"letsencrypt.acme","time":"2025-03-21T11:49:44Z","message":"Register..."} {"level":"warn","time":"2025-03-21T11:59:36Z","message":"A new release of Traefik has been found: 3.3.4. Please consider updating."} ``` gerbil logs: ``` INFO: 2025/03/21 11:49:28 Fetching remote config from http://pangolin:3001/api/v1/gerbil/get-config INFO: 2025/03/21 11:49:34 Created WireGuard interface wg0 INFO: 2025/03/21 11:49:34 Assigned IP address xx.xx.xx.xx/24 to interface wg0 INFO: 2025/03/21 11:49:34 Attempting to delete existing MSS clamping rule for chain INPUT INFO: 2025/03/21 11:49:34 Attempting to delete existing MSS clamping rule for chain OUTPUT INFO: 2025/03/21 11:49:34 Attempting to delete existing MSS clamping rule for chain FORWARD INFO: 2025/03/21 11:49:34 Adding MSS clamping rule for chain INPUT INFO: 2025/03/21 11:49:34 Successfully added and verified MSS clamping rule for chain INPUT INFO: 2025/03/21 11:49:34 Adding MSS clamping rule for chain OUTPUT INFO: 2025/03/21 11:49:34 Successfully added and verified MSS clamping rule for chain OUTPUT INFO: 2025/03/21 11:49:34 Adding MSS clamping rule for chain FORWARD INFO: 2025/03/21 11:49:34 Successfully added and verified MSS clamping rule for chain FORWARD INFO: 2025/03/21 11:49:34 WireGuard interface wg0 created and configured INFO: 2025/03/21 11:49:34 Starting server on :3003 ``` pangolin logs: ``` > @fosrl/pangolin@0.0.0 start > NODE_OPTIONS=--enable-source-maps NODE_ENV=development ENVIRONMENT=prod sh -c 'node dist/migrations.mjs && node dist/server.mjs' Running migrations... Migrations completed successfully. 2025-03-21T11:49:23.823Z [info]: Server admin (<email>) created 2025-03-21T11:49:26.233Z [info]: API server is running on http://localhost:3000 2025-03-21T11:49:26.288Z [info]: Internal server is running on http://localhost:3001 2025-03-21T11:49:27.094Z [info]: Next.js server is running on http://localhost:3002 2025-03-21T11:49:33.697Z [info]: Created new exit node Exit Node ja/R09vR with address xx.xx.xx.xx/24 and port 51820 ``` Crowdsec logs: ``` time="2025-03-21T12:24:40Z" level=info msg="127.0.0.1 - [Fri, 21 Mar 2025 12:24:40 UTC] \"GET /v1/allowlists?with_content=true HTTP/1.1 200 3.459685ms \"crowdsec/v1.6.6-416eb27f-docker\" \"" time="2025-03-21T12:25:40Z" level=info msg="127.0.0.1 - [Fri, 21 Mar 2025 12:25:40 UTC] \"GET /v1/heartbeat HTTP/1.1 200 5.426621ms \"crowdsec/v1.6.6-416eb27f-docker\" \"" time="2025-03-21T12:25:40Z" level=info msg="127.0.0.1 - [Fri, 21 Mar 2025 12:25:40 UTC] \"GET /v1/allowlists?with_content=true HTTP/1.1 200 1.376711ms \"crowdsec/v1.6.6-416eb27f-docker\" \"" ```

MrUnknownDE closed this issue

2026-04-05 19:39:42 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#1695