# Crowdsec Whitelist won't work

**URL:** <https://discourse.crowdsec.net/t/crowdsec-whitelist-wont-work/2095>\
**Category:** crowdsec\
**Created:** [October 25, 2024, 8:03am UTC](https://discourse.crowdsec.net/t/crowdsec-whitelist-wont-work/2095 "2024-10-25T08:03:34Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![h725rk](https://avatars.discourse-cdn.com/v4/letter/h/85e7bf/32.png) [@h725rk](https://discourse.crowdsec.net/u/h725rk)\
**Post date:** [October 25, 2024, 8:03am UTC](https://discourse.crowdsec.net/t/crowdsec-whitelist-wont-work/2095/1 "2024-10-25T08:03:34Z")

</div>

Hello,

I have actual a problem with a IP from my Webhoster.  
Crowdsec banned the IP, but I don’t know why?  
But my problem is a other problem.  
I have created a whitelist “/etc/crowdsec/parsers/s02-enrich/mywhitelists.yaml” and added the following

```auto
name: crowdsecurity/whitelists
description: "Whitelist for me"
whitelist:
  reason: "Whitelist for working"
  ip:
    - "IP" # Webhosting

```

After this I restarted crowdsec and check, if the mywhitelists.yaml will be parsed.  
I checked it with “cscli parsers list” and the list will be parsed:

```auto
crowdsecurity/whitelists 🏠 enabled,local /etc/crowdsec/parsers/s02-enrich/mywhitelists.yaml

```

I unban the IP and it works. But after 2 hours the IP is on the banlist again and I have no access to my Webhosting.

Is there a problem with my whitelist or something else?  
How can I whitelist my IP?

Thanks,  
Robert

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [October 25, 2024, 10:30am UTC](https://discourse.crowdsec.net/t/crowdsec-whitelist-wont-work/2095/2 "2024-10-25T10:30:10Z")

</div>

my suggestion as per our whitelist documentation is name the `name` key something different

```auto
name: my/whitelists
description: "Whitelist for me"
whitelist:
  reason: "Whitelist for working"
  ip:
    - "IP" # Webhosting

```

[Getting started whitelist documentation](https://docs.crowdsec.net/u/getting_started/post_installation/whitelists#static-ip-address)

this will stop any conflict with our official `crowdsecurity/whitelists` parser.

You can test this by running

```bash
grep <IP> /var/log/<your_log_file> | tail -n1 | cscli explain -f- --type <log_type>

```

this will show you if the whitelist is passing.

[documentation on testing](https://docs.crowdsec.net/u/getting_started/post_installation/whitelists#testing-your-whitelist)

Once you have confirmed this you need to restart CrowdSec by running `systemctl restart crowdsec`

Edit: What I said above only applies to log parsers, it seem from this comment

```auto
But after 2 hours the IP is on the banlist again and I have no access to my Webhosting.

```

That the IP address you want to whitelist is in fact in the “Community Blocklist”, because the Security Engine pulls updates every 2 hours.

If this is the case then you can use [this guide here](https://docs.crowdsec.net/docs/next/whitelist/create_capi) to whitelist decisions that come from the Community Blocklist.

---

<div class="post-metadata">

**Author:** ![h725rk](https://avatars.discourse-cdn.com/v4/letter/h/85e7bf/32.png) [@h725rk](https://discourse.crowdsec.net/u/h725rk)\
**Post date:** [October 25, 2024, 2:15pm UTC](https://discourse.crowdsec.net/t/crowdsec-whitelist-wont-work/2095/3 "2024-10-25T14:15:08Z")

</div>

The problem is bigger.  
The Mailsupport has helped me.

The IP ist on a blacklist from Crowdsec and they don’t want delete it.  
The solution was a CAPI-Whitelist. [CAPI | CrowdSec](https://docs.crowdsec.net/docs/whitelist/create_capi)  
It works for me.

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [October 25, 2024, 2:42pm UTC](https://discourse.crowdsec.net/t/crowdsec-whitelist-wont-work/2095/4 "2024-10-25T14:42:33Z")

</div>

It was myself on the mail support, its not that we don’t want to delete it. It more we are still seeing malicious signals, so we have to weigh up releasing the IP for the context it is a hosting company but also noting that their is still active attacking users of our network.

---

<div class="post-metadata">

**Author:** ![h725rk](https://avatars.discourse-cdn.com/v4/letter/h/85e7bf/32.png) [@h725rk](https://discourse.crowdsec.net/u/h725rk)\
**Post date:** [October 25, 2024, 3:09pm UTC](https://discourse.crowdsec.net/t/crowdsec-whitelist-wont-work/2095/5 "2024-10-25T15:09:18Z")

</div>

It’s OK.  
I meant no harm. You helped me with the CAPI-Whitelist.  
On this Webhosting-IP, there are 81 Domains and I own 2 of it.