# Sonarr, Radarr, Lidarr or Prowlarr refused this address

When Allowed Hosts is set, the *arr apps reject any address that is not on the list, including LAN and Tailscale addresses. Add each address Kochab uses, then restart.

Canonical: https://kochab.io/docs/troubleshooting/arr-refused-this-address/

The service loads at one address but not another, and Kochab shows a message like this (with
your service's name):

> Sonarr refused requests for this address. Add this address to Allowed Hosts in Sonarr Settings >
> General, then restart Sonarr.

The same applies to Radarr, Lidarr and Prowlarr.

## Why the service does this

**Allowed Hosts** is a security setting in the *arr apps (added to Sonarr in
[commit 5f69ab0](https://github.com/Sonarr/Sonarr/commit/5f69ab095)), and later updates keep it. When the list is set, the service checks the address each request was sent to
and answers any address not on the list with HTTP 400 "Invalid Hostname".

Only `localhost`, the loopback addresses and the server's own machine name are allowed
automatically. Everything else has to be listed, including:

- the LAN IP address you use at home
- a Tailscale IP or MagicDNS name
- the hostname of your reverse proxy or tunnel

So a service can pass on one address and fail on another. If you gave Kochab both a home address
and an external address, put both on the list.

If Allowed Hosts is empty, the service accepts every address and this message cannot appear.

## Fix: add every address Kochab uses

1. In the service's web UI, open **Settings > General**.
2. Find **Allowed Hosts** in the **Host** section.
3. Add each address Kochab connects with, separated by commas. Use the hostname or IP only, with
   no `http://`, port or path. A wildcard such as `*.example.com` covers every subdomain.
4. Save, then restart the service. The list does not take effect until it restarts.
5. In Kochab, run the connection test again.

Repeat for each *arr that shows the message. The setting is separate in Sonarr, Radarr, Lidarr and
Prowlarr.

## Fallback: clear the list

If you would rather not keep a list, clear **Allowed Hosts** and restart the service. It then
accepts any address again. Kochab still needs the API key either way.

## Related

- [Reverse proxies and remote access](/docs/remote-access/)
- [Remote access with Tailscale](/docs/remote-access-tailscale/)
- [Remote access with nginx or SWAG](/docs/remote-access-nginx-swag/)
- [Why won't Kochab connect to my service?](/docs/troubleshooting/service-wont-connect/)