# How allowedCIDRs works?

**URL:** <https://community.cratedb.com/t/how-allowedcidrs-works/1923>\
**Category:** Installation\
**Created:** [December 8, 2024, 7:09pm UTC](https://community.cratedb.com/t/how-allowedcidrs-works/1923 "2024-12-08T19:09:30Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![MirtoBusico](https://sea2.discourse-cdn.com/flex020/user_avatar/community.cratedb.com/mirtobusico/32/1322_2.png) [@MirtoBusico](https://community.cratedb.com/u/MirtoBusico)\
**Post date:** [December 8, 2024, 7:09pm UTC](https://community.cratedb.com/t/how-allowedcidrs-works/1923/1 "2024-12-08T19:09:30Z")

</div>

Sorry, I’m here again.

I don’t understand how allowedCIDRs works or mybe I don’t understand host authentication.

Before restricting network access with allowedCIDRs I was able to access the CrateDB UI both from the load balancer address and from the nginx reverse proxy (that manages HTTPS protocol and load balance three kubernetes nodes).

Now, using allowedCIDRs i receive the errors after trying the authentication: the login popup window appear but clicking the access button nothing happens; clicking the cancel button gives an error page.

Here the errors:  
With “[http://192.168.151.21:4200/](http://192.168.151.21:4200/)” URL I receive:

```auto
No valid auth.host_based.config entry found for host "192.168.151.1", user "crate", protocol "http". Did you enable TLS in your client?

```

with the “[https://crate.h5a.net/](https://crate.h5a.net/)” URL I receive:

```auto
No valid auth.host_based.config entry found for host "192.168.151.33", user "crate", protocol "http". Did you enable TLS in your client?

```

I created the CrateDB cluster with crate-operator with these commands

```auto
kubectl create namespace crate-operator
kubectl create namespace for-crate
helm install crate-operator crate-operator/crate-operator --namespace crate-operator --set env.CRATEDB_OPERATOR_DEBUG_VOLUME_STORAGE_CLASS=longhorn --set env.CRATEDB_OPERATOR_DEBUG_VOLUME_SIZE=4GiB
kubectl --namespace for-crate create -f my-crate.yaml

```

where my-crate.yaml contains

```auto
apiVersion: cloud.crate.io/v1
kind: CrateDB
metadata:
  name: my-cluster
  namespace: for-crate
spec:
  cluster:
    imageRegistry: crate
    name: my-crate
    version: 5.8.1
    allowedCIDRs:
    - 192.168.151.0/24
    - 10.0.0.0/8
  nodes:
    data:
    - name: hot
      replicas: 3
      resources:
        limits:
          cpu: 4
          memory: 4Gi
        disk:
          count: 1
          size: 16GiB
          storageClass: longhorn
        heapRatio: 0.25

```

The services are

```auto
sysop@h5a-dev:~$ kubectl get svc -n for-crate
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
crate-discovery-my-cluster ClusterIP None <none> 4300/TCP,4200/TCP,5432/TCP 3d8h
crate-my-cluster LoadBalancer 10.43.47.153 192.168.151.21,192.168.151.22,192.168.151.23 4200:31656/TCP,5432:30136/TCP 3d8h
sysop@h5a-dev:~$ 

```

So I’m trying to enable host authentication restricted to the “192.168.151.0/24” external network and “10.0.0.0/8” internal network

What I’m doing wrong?

---

<div class="post-metadata">

**Author:** ![hernanc](https://sea2.discourse-cdn.com/flex020/user_avatar/community.cratedb.com/hernanc/32/676_2.png) [@hernanc](https://community.cratedb.com/u/hernanc)\
**Post date:** [December 9, 2024, 8:01am UTC](https://community.cratedb.com/t/how-allowedcidrs-works/1923/2 "2024-12-09T08:01:15Z")

</div>

Hi,

> [@MirtoBusico](#):
>
> clicking the access button nothing happens

Are you using the `system` user with the password that comes out from running `get secret` as in [Run CrateDB with Kubernetes Operator - CrateDB: Guide](https://cratedb.com/docs/guide/install/container/kubernetes/kubernetes-operator.html) ?

---

<div class="post-metadata">

**Author:** ![MirtoBusico](https://sea2.discourse-cdn.com/flex020/user_avatar/community.cratedb.com/mirtobusico/32/1322_2.png) [@MirtoBusico](https://community.cratedb.com/u/MirtoBusico)\
**Post date:** [December 9, 2024, 9:53am UTC](https://community.cratedb.com/t/how-allowedcidrs-works/1923/3 "2024-12-09T09:53:49Z")

</div>

Yes  
I got the password with

```auto
sysop@h5a-dev:~/h5a/h5a-certs$ kubectl get secret user-system-my-cluster -o json -n for-crate| jq -r '.data.password' | base64 -d
S9xsloAiGVvZ7iqaDQjtAzasmiFedEYlc1ajapZWDikhPbZTkjsysop@h5a-dev:~/h5a/h5a-certs$ 
sysop@h5a-dev:~/h5a/h5a-certs$ kubectl get service crate-my-cluster -o json -n for-crate | jq -r '.status.loadBalancer.ingress[0].ip'
192.168.151.21
sysop@h5a-dev:~/h5a/h5a-certs$

```

Before adding the allowedCIDRs restrictions I was able to login with the system user and the gathered password

 ![cratedb-1](https://us1.discourse-cdn.com/flex020/uploads/crate/original/2X/6/6f667f766885566f5775e0d753236079f855fe48.png)

 ![cratedb-2](https://us1.discourse-cdn.com/flex020/uploads/crate/original/2X/1/19739970e43f5baa935bbef35768f6d76677f4f5.jpeg)

But now I receive the errors; so I think that the cause is the added restriction.

---

<div class="post-metadata">

**Author:** ![MirtoBusico](https://sea2.discourse-cdn.com/flex020/user_avatar/community.cratedb.com/mirtobusico/32/1322_2.png) [@MirtoBusico](https://community.cratedb.com/u/MirtoBusico)\
**Post date:** [December 10, 2024, 5:57pm UTC](https://community.cratedb.com/t/how-allowedcidrs-works/1923/4 "2024-12-10T17:57:03Z")

</div>

Sorry I used the wrong password from a previous installation.

Gathering again the password and using the new value worked and I can access again the UI