starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

Setting "Allowed IPs" for a Token Results in 403 Error When Connecting With Ansible Collection/pynetbox #7090

New Issue
Closed
opened 2025-12-29 20:19:08 +01:00 by adam · 1 comment
adam commented 2025-12-29 20:19:08 +01:00
Owner
Copy Link

Originally created by @eramnes on GitHub (Oct 7, 2022).

NetBox version

v3.3.4

Python version

3.9

Steps to Reproduce

  1. Create a new API token on the "API Tokens" page. Set a list of "Allowed IPs" for an IPv4 address or range where you would like this token to be usable from.
  2. Provide this token to a playbook using the Ansible Netbox collection. Attempt to run a playbook or lookup on a system with an IPv4 address that would be accepted by the "Allowed IPs" configured for this token.

Expected Behavior

The playbook actions or lookup should succeed and perform the operation or return data.

Observed Behavior

fatal: [localhost]: FAILED! => {"msg": "An unhandled exception occurred while running the lookup plugin 'netbox.netbox.nb_lookup'. Error was a <class 'pynetbox.core.query.RequestError'>, original message: The request failed with code 403 Forbidden: {'detail': 'Source IP ::ffff:172.16.74.167 is not permitted to authenticate using this token.'}"}

It appears that the IPv4 to IPv6 subnet prefix is not being stripped. Since there is field validation on the "Allowed IPs" field, trying to add the prefix to the IP(or range) that's allowed won't succeed, since that's isn't a valid IPv4 address.

If I remove the "Allowed IPs" from the token, it works as expected.

To be honest I am not sure if this is a pynetbox issue or a netbox-community issue, but since the 403 is returned from Netbox it seems that there should be something in Netbox that strips the IPv4 to IPv6 subnet prefix before attempting to validate that the IP would be allowed.

Originally created by @eramnes on GitHub (Oct 7, 2022). ### NetBox version v3.3.4 ### Python version 3.9 ### Steps to Reproduce 1. Create a new API token on the "API Tokens" page. Set a list of "Allowed IPs" for an IPv4 address or range where you would like this token to be usable from. 2. Provide this token to a playbook using the Ansible Netbox collection. Attempt to run a playbook or lookup on a system with an IPv4 address that would be accepted by the "Allowed IPs" configured for this token. ### Expected Behavior The playbook actions or lookup should succeed and perform the operation or return data. ### Observed Behavior `fatal: [localhost]: FAILED! => {"msg": "An unhandled exception occurred while running the lookup plugin 'netbox.netbox.nb_lookup'. Error was a <class 'pynetbox.core.query.RequestError'>, original message: The request failed with code 403 Forbidden: {'detail': 'Source IP ::ffff:172.16.74.167 is not permitted to authenticate using this token.'}"}` It appears that the IPv4 to IPv6 subnet prefix is not being stripped. Since there is field validation on the "Allowed IPs" field, trying to add the prefix to the IP(or range) that's allowed won't succeed, since that's isn't a valid IPv4 address. If I remove the "Allowed IPs" from the token, it works as expected. To be honest I am not sure if this is a pynetbox issue or a netbox-community issue, but since the 403 is returned from Netbox it seems that there should be something in Netbox that strips the IPv4 to IPv6 subnet prefix before attempting to validate that the IP would be allowed.
adam closed this issue 2025-12-29 20:19:08 +01:00
adam commented 2025-12-29 20:19:09 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Oct 7, 2022):

Provide this token to a playbook using the Ansible Netbox collection. Attempt to run a playbook or lookup on a system with an IPv4 address that would be accepted by the "Allowed IPs" configured for this token.

This is outside the scope of the NetBox project. Please raise a bug against the software you're using.

@jeremystretch commented on GitHub (Oct 7, 2022): > Provide this token to a playbook using the Ansible Netbox collection. Attempt to run a playbook or lookup on a system with an IPv4 address that would be accepted by the "Allowed IPs" configured for this token. This is outside the scope of the NetBox project. Please raise a bug against the software you're using.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#7090
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?