# Why artifacts.elastic.co/GPG-KEY-elasticsearch returns 403 for russian IPs, but not always? **URL:** \ **Category:** Вопросы на русском языке\ **Created:** [March 29, 2022, 1:41pm UTC](https://discuss.elastic.co/t/why-artifacts-elastic-co-gpg-key-elasticsearch-returns-403-for-russian-ips-but-not-always/300969 "2022-03-29T13:41:47Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![h\_Kleiser](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/h_kleiser/32/103652_2.png) [@h\_Kleiser](https://discuss.elastic.co/u/h_Kleiser)\ **Post date:** [March 29, 2022, 1:41pm UTC](https://discuss.elastic.co/t/why-artifacts-elastic-co-gpg-key-elasticsearch-returns-403-for-russian-ips-but-not-always/300969/1 "2022-03-29T13:41:47Z")
I'm making rpm --import [https://artifacts.elastic.co/GPG-KEY-elasticsearch](https://artifacts.elastic.co/GPG-KEY-elasticsearch) and it return 403, but not always, like 30% of all request passes normally. What's the point of such behaviour? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [March 29, 2022, 10:30pm UTC](https://discuss.elastic.co/t/why-artifacts-elastic-co-gpg-key-elasticsearch-returns-403-for-russian-ips-but-not-always/300969/2 "2022-03-29T22:30:01Z")
Welcome to our community. We are currently blocking Russian IPs due to the war, please see [Elastic підтримує Україну | Elastic Blog](https://www.elastic.co/blog/elastic-stands-with-ukraine-ukrainian). ---
**Author:** ![GreenX](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/greenx/32/51751_2.png) [@GreenX](https://discuss.elastic.co/u/GreenX)\ **Post date:** [March 30, 2022, 6:45am UTC](https://discuss.elastic.co/t/why-artifacts-elastic-co-gpg-key-elasticsearch-returns-403-for-russian-ips-but-not-always/300969/3 "2022-03-30T06:45:01Z")
Странное решение. На уровне насрать под дверью. Чем поможет блокировка IP из РФ простым людям в Украине? При том, что в релизе разговор только об окончании продаж в РФ. ---
**Author:** ![tibyke](https://avatars.discourse-cdn.com/v4/letter/t/bbce88/32.png) [@tibyke](https://discuss.elastic.co/u/tibyke)\ **Post date:** [April 1, 2022, 2:54pm UTC](https://discuss.elastic.co/t/why-artifacts-elastic-co-gpg-key-elasticsearch-returns-403-for-russian-ips-but-not-always/300969/5 "2022-04-01T14:54:02Z")
hello! how about Italy? ````auto $ curl -qsIv https://artifacts.elastic.co/packages/8.x/yum/8.1.2/kibana-8.1.2-x86_64.rpm * About to connect() to artifacts.elastic.co port 443 (#0) * Trying 34.120.127.130... * Connected to artifacts.elastic.co (34.120.127.130) port 443 (#0) * Initializing NSS with certpath: sql:/etc/pki/nssdb * CAfile: /etc/pki/tls/certs/ca-bundle.crt CApath: none * SSL connection using TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 * Server certificate: * subject: CN=appsearch.elastic.co * start date: Mar 24 12:59:46 2022 GMT * expire date: Jun 22 12:59:45 2022 GMT * common name: appsearch.elastic.co * issuer: CN=GTS CA 1D4,O=Google Trust Services LLC,C=US > HEAD /packages/8.x/yum/8.1.2/kibana-8.1.2-x86_64.rpm HTTP/1.1 > User-Agent: curl/7.29.0 > Host: artifacts.elastic.co > Accept: */* > < HTTP/1.1 403 Forbidden HTTP/1.1 403 Forbidden < Content-Length: 134 Content-Length: 134 < Content-Type: text/html; charset=UTF-8 Content-Type: text/html; charset=UTF-8 < Date: Fri, 01 Apr 2022 14:51:20 GMT Date: Fri, 01 Apr 2022 14:51:20 GMT < Alt-Svc: clear Alt-Svc: clear < * Connection #0 to host artifacts.elastic.co left intact $ curl ipinfo.io { "ip": "80.211.x.y", "hostname": "foo.bar.baz", "city": "Rome", "region": "Lazio", "country": "IT", "loc": "41.8919,12.5113", "org": "AS31034 Aruba S.p.A.", "postal": "00118", "timezone": "Europe/Rome", "readme": "https://ipinfo.io/missingauth" }``` ```` ---
**Author:** ![JoseEstralla](https://avatars.discourse-cdn.com/v4/letter/j/ed8c4c/32.png) [@JoseEstralla](https://discuss.elastic.co/u/JoseEstralla)\ **Post date:** [April 9, 2022, 1:52am UTC](https://discuss.elastic.co/t/why-artifacts-elastic-co-gpg-key-elasticsearch-returns-403-for-russian-ips-but-not-always/300969/6 "2022-04-09T01:52:37Z")
seem to have same issue here, Slovakia is blcoked. cool ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [April 25, 2022, 10:44pm UTC](https://discuss.elastic.co/t/why-artifacts-elastic-co-gpg-key-elasticsearch-returns-403-for-russian-ips-but-not-always/300969/9 "2022-04-25T22:44:08Z")
We're happy to dig into issues of IPs outside of Russia being blocked, please provide the IP you are coming from so we can dig into it. Any non technical posts in this topic will be deleted. ---
**Author:** ![sonofobstacle](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sonofobstacle/32/98445_2.png) [@sonofobstacle](https://discuss.elastic.co/u/sonofobstacle)\ **Post date:** [April 26, 2022, 6:40pm UTC](https://discuss.elastic.co/t/why-artifacts-elastic-co-gpg-key-elasticsearch-returns-403-for-russian-ips-but-not-always/300969/10 "2022-04-26T18:40:17Z")
We are facing similar issues. Can you have a look at the range 91.197.40.0/22? It does belong to a Swedish cloud provider and should have very little to do with Russia =) ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [April 27, 2022, 10:34pm UTC](https://discuss.elastic.co/t/why-artifacts-elastic-co-gpg-key-elasticsearch-returns-403-for-russian-ips-but-not-always/300969/12 "2022-04-27T22:34:39Z")
Yep this looks like it's inadvertently impacted, we're chasing it up for you. ---
**Author:** ![tibyke](https://avatars.discourse-cdn.com/v4/letter/t/bbce88/32.png) [@tibyke](https://discuss.elastic.co/u/tibyke)\ **Post date:** [May 4, 2022, 7:07am UTC](https://discuss.elastic.co/t/why-artifacts-elastic-co-gpg-key-elasticsearch-returns-403-for-russian-ips-but-not-always/300969/13 "2022-05-04T07:07:00Z")
massive 403, pls sort it! ```auto # curl -qs ipinfo.io | jq '.' { "ip": "80.211.174.xxx", "hostname": "x.y.z", "city": "Rome", "region": "Lazio", "country": "IT", "loc": "41.8919,12.5113", "org": "AS31034 Aruba S.p.A.", "postal": "00118", "timezone": "Europe/Rome", "readme": "https://ipinfo.io/missingauth" } ``` ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 5, 2022, 12:32am UTC](https://discuss.elastic.co/t/why-artifacts-elastic-co-gpg-key-elasticsearch-returns-403-for-russian-ips-but-not-always/300969/14 "2022-05-05T00:32:17Z")
Is this from all IPs in the range @tibyke? If not, please DM me the relevant one. ---
**Author:** ![tibyke](https://avatars.discourse-cdn.com/v4/letter/t/bbce88/32.png) [@tibyke](https://discuss.elastic.co/u/tibyke)\ **Post date:** [May 5, 2022, 7:57am UTC](https://discuss.elastic.co/t/why-artifacts-elastic-co-gpg-key-elasticsearch-returns-403-for-russian-ips-but-not-always/300969/15 "2022-05-05T07:57:45Z")
I only have one address in that range, and it has been blocked for a couple of months now. (obviously I haven't done anything bad at all) btw it's 971 backwards. how come you don't know what the rules are? you set them up don't you? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 5, 2022, 8:28am UTC](https://discuss.elastic.co/t/why-artifacts-elastic-co-gpg-key-elasticsearch-returns-403-for-russian-ips-but-not-always/300969/16 "2022-05-05T08:28:50Z")
> [@tibyke](#): > > how come you don't know what the rules are? you set them up don't you? I do not, no. I'll get it checked. ---
**Author:** ![tibyke](https://avatars.discourse-cdn.com/v4/letter/t/bbce88/32.png) [@tibyke](https://discuss.elastic.co/u/tibyke)\ **Post date:** [May 9, 2022, 10:20am UTC](https://discuss.elastic.co/t/why-artifacts-elastic-co-gpg-key-elasticsearch-returns-403-for-russian-ips-but-not-always/300969/17 "2022-05-09T10:20:11Z")
any update on this one? (still 403) ```auto # curl -qso/dev/null https://artifacts.elastic.co/packages/8.x/yum/8.2.0/kibana-8.2.0-x86_64.rpm -w "%{http_code}\n" 403 ``` ---
**Author:** ![tibyke](https://avatars.discourse-cdn.com/v4/letter/t/bbce88/32.png) [@tibyke](https://discuss.elastic.co/u/tibyke)\ **Post date:** [May 10, 2022, 10:17am UTC](https://discuss.elastic.co/t/why-artifacts-elastic-co-gpg-key-elasticsearch-returns-403-for-russian-ips-but-not-always/300969/18 "2022-05-10T10:17:27Z")
```auto # curl -qso/dev/null https://artifacts.elastic.co/packages/8.x/yum/8.2.0/kibana-8.2.0-x86_64.rpm -w "%{http_code}\n" 200 ``` thx! ---
**Author:** ![drewr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/drewr/32/7803_2.png) [@drewr](https://discuss.elastic.co/u/drewr)\ **Post date:** [May 17, 2022, 4:50pm UTC](https://discuss.elastic.co/t/why-artifacts-elastic-co-gpg-key-elasticsearch-returns-403-for-russian-ips-but-not-always/300969/19 "2022-05-17T16:50:03Z")
Hi everyone, we're really sorry you're experiencing these issues. This is a very difficult problem to resolve so I wanted to at least explain why it's happening. Elastic must comply with [US and other applicable laws and rules regulating international trade](https://home.treasury.gov/policy-issues/office-of-foreign-assets-control-sanctions-programs-and-information). As you likely have heard, numerous Russian entities and persons have been sanctioned by the US, EU and many other governments as a result of Russia’s invasion of Ukraine. In addition, extremely strict controls have been imposed on exports of technology, including Elastic products, to Russian users. These sanctions and controls prohibit conducting any business with sanctioned companies and persons and bar Elastic from exporting its technology to Russia. The standard way to determine network access is with geoip lookups, and we rely on our network providers to do accurate geoip lookups. This service is hosted through GCP. Google is a US-based company, and therefore has to obey those laws. Note that even if Google did not already provide this protection, we're obligated by US law to do it anyway. However, that's not technically what's causing the errors here. When you encounter an IP that's blocked, I'm afraid all you can do is report it to us and wait while we engage the support team on your behalf. We actually experience this issue inside Elastic with our own cross-provider traffic and must work around it too. Thank for your continued patience. Finally, please know that while we stand with Ukraine, we at Elastic are heartbroken that the people of Russia are also suffering from the actions of the Russian government. Many of our own employees have been directly affected by this conflict and we join the world in hoping that it will end as soon as possible. ---
**Author:** ![Hugo\_Blom](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hugo_blom/32/106876_2.png) [@Hugo\_Blom](https://discuss.elastic.co/u/Hugo_Blom)\ **Post date:** [June 10, 2022, 12:32pm UTC](https://discuss.elastic.co/t/why-artifacts-elastic-co-gpg-key-elasticsearch-returns-403-for-russian-ips-but-not-always/300969/20 "2022-06-10T12:32:16Z")
Hello, I have full understanding in that you guys follow the requirement however it would be nice to update your GEOIP database before enforcing this. We still experience issues with on of our /22 that was moved to Sweden over 2 years ago. Would it be possible for you guys to "fix/check" our IP range? 91.197.40.0/22 Thanks in advance and just let me know in case of any questions/problems ```auto ubuntu@testvm1:~$ curl -I https://artifacts.elastic.co/packages/7.x/apt/pool/main/e/elasticsearch/elasticsearch-7.16.1-amd64.deb HTTP/2 403 content-length: 134 content-type: text/html; charset=UTF-8 date: Fri, 10 Jun 2022 12:28:42 GMT alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 ``` ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [June 14, 2022, 12:31am UTC](https://discuss.elastic.co/t/why-artifacts-elastic-co-gpg-key-elasticsearch-returns-403-for-russian-ips-but-not-always/300969/21 "2022-06-14T00:31:29Z")
Welcome to our community! 😃 We aren't all guys though. As Drew mentioned above, we do rely on Google's lookups here. We will raise this range with them and get it corrected. ---
**Author:** ![tibyke](https://avatars.discourse-cdn.com/v4/letter/t/bbce88/32.png) [@tibyke](https://discuss.elastic.co/u/tibyke)\ **Post date:** [June 15, 2022, 3:37pm UTC](https://discuss.elastic.co/t/why-artifacts-elastic-co-gpg-key-elasticsearch-returns-403-for-russian-ips-but-not-always/300969/22 "2022-06-15T15:37:59Z")
my 403 is back again! what's going on here guys (and girls) ? IP is the same as above ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [June 16, 2022, 4:51am UTC](https://discuss.elastic.co/t/why-artifacts-elastic-co-gpg-key-elasticsearch-returns-403-for-russian-ips-but-not-always/300969/23 "2022-06-16T04:51:58Z")
I've chased it up. ---
**Author:** ![tibyke](https://avatars.discourse-cdn.com/v4/letter/t/bbce88/32.png) [@tibyke](https://discuss.elastic.co/u/tibyke)\ **Post date:** [June 20, 2022, 11:31am UTC](https://discuss.elastic.co/t/why-artifacts-elastic-co-gpg-key-elasticsearch-returns-403-for-russian-ips-but-not-always/300969/24 "2022-06-20T11:31:44Z")
any update? [Next page](https://discuss.elastic.co/t/why-artifacts-elastic-co-gpg-key-elasticsearch-returns-403-for-russian-ips-but-not-always/300969.md?page=2)