[PR #2843] [MERGED] Exclude local/private/CGNAT IPs from geo-block rules (fixes issue #2239) #31106

New Issue

2026-06-13T11:33:23-05:00

GiteaMirror commented

2026-06-13 11:33:23 -05:00

📋 Pull Request Information

Original PR: https://github.com/fosrl/pangolin/pull/2843
Author: @Blacks-Army
Created: 4/12/2026
Status: ✅ Merged
Merged: 5/3/2026
Merged by: @oschwartz10612

Base: dev ← Head: dev

📝 Commits (2)

8e1905a Exclude local/private/CGNAT IPs from COUNTRY=ALL and ASN=ALL/AS0 geo-blocking rules
b2c8311 Merge branch 'fosrl:dev' into dev

📊 Changes

1 file changed (+50 additions, -7 deletions)

View changed files

📝 server/routers/badger/verifySession.ts (+50 -7)

📄 Description

Community Contribution License Agreement

By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.

Description

Fixes issue #2239

Disclaimer:
This is my first contribution to Pangolin, so please bear with me 😅

This PR updates geo wildcard rule behavior for non-public source IPs.

COUNTRY=ALL with action BLOCK: local/private/CGNAT IPs are skipped
ASN=ALL / ASN=AS0 with action BLOCK: local/private/CGNAT IPs are skipped
Explicit CIDR / IP rules are unchanged

Why this makes sense:

local/private/CGNAT IPs are not meaningfully geolocatable
wildcard geo block rules should target public Internet IPs
intentional blocking is still possible via CIDR, including:
- 0.0.0.0/0 (IPv4)
- ::/0 (IPv6)

How to test?

Add rule COUNTRY=ALL or ASN=ALL, action BLOCK, send request from 192.168.1.10 --> not blocked by this rule.
Add rule CIDR=192.168.0.0/16, action BLOCK --> IP is blocked.
Add rule CIDR=0.0.0.0/0 (or ::/0 for IPv6), action BLOCK -> IP is also blocked.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/fosrl/pangolin/pull/2843 **Author:** [@Blacks-Army](https://github.com/Blacks-Army) **Created:** 4/12/2026 **Status:** ✅ Merged **Merged:** 5/3/2026 **Merged by:** [@oschwartz10612](https://github.com/oschwartz10612) **Base:** `dev` ← **Head:** `dev` --- ### 📝 Commits (2) - [`8e1905a`](https://github.com/fosrl/pangolin/commit/8e1905a695add77d18ca8a2e16cd4c40437bbca9) Exclude local/private/CGNAT IPs from COUNTRY=ALL and ASN=ALL/AS0 geo-blocking rules - [`b2c8311`](https://github.com/fosrl/pangolin/commit/b2c8311b2676700afbc3667d721eb1a04e6a3483) Merge branch 'fosrl:dev' into dev ### 📊 Changes **1 file changed** (+50 additions, -7 deletions) <details> <summary>View changed files</summary> 📝 `server/routers/badger/verifySession.ts` (+50 -7) </details> ### 📄 Description ## Community Contribution License Agreement By creating this pull request, I grant the project maintainers an unlimited, perpetual license to use, modify, and redistribute these contributions under any terms they choose, including both the AGPLv3 and the Fossorial Commercial license terms. I represent that I have the right to grant this license for all contributed content. ## Description Fixes issue #2239 Disclaimer: This is my first contribution to Pangolin, so please bear with me 😅 This PR updates geo wildcard rule behavior for non-public source IPs. - `COUNTRY=ALL` with action `BLOCK`: local/private/CGNAT IPs are skipped - `ASN=ALL` / `ASN=AS0` with action `BLOCK`: local/private/CGNAT IPs are skipped - Explicit `CIDR` / `IP` rules are unchanged Why this makes sense: - local/private/CGNAT IPs are not meaningfully geolocatable - wildcard geo block rules should target public Internet IPs - intentional blocking is still possible via CIDR, including: - `0.0.0.0/0` (IPv4) - `::/0` (IPv6) ## How to test? 1. Add rule `COUNTRY=ALL` or `ASN=ALL`, action `BLOCK`, send request from `192.168.1.10` --> not blocked by this rule. 2. Add rule `CIDR=192.168.0.0/16`, action `BLOCK` --> IP is blocked. 3. Add rule `CIDR=0.0.0.0/0` (or `::/0` for IPv6), action `BLOCK` -> IP is also blocked. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2026-06-13 11:33:23 -05:00

GiteaMirror closed this issue

2026-06-13 11:33:24 -05:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/pangolin#31106