Originally assigned to: @oschwartz10612 on GitHub.
Describe the Bug
When using GeoIP-based rules in Pangolin, internal/private IP ranges (LAN and CGNAT) can be unintentionally blocked.
For example, if you create a rule to Bypass Auth for your country with high priority, and then a Block All rule for all countries with lower priority, clients using private IP ranges (192.168.x.x / 10.x.x.x / 172.16.x.x) or CGNAT ranges (100.64.0.0/10) or private ipv6 IP ranges cannot reach the service. This happens because these IPs do not have GeoIP mapping, so the “Block All” rule applies.
Environment
OS Type & Version: Docker
Pangolin Version: latest
Gerbil Version: latest
Traefik Version: latest
Newt Version: latest
Olm Version: (if applicable)
To Reproduce
Create a rule with Priority 1: Bypass Auth for a specific country (e.g., USA).
Create a rule with Priority 2: Block All for all countries.
Try accessing the service from a client with a private LAN IP (192.168.x.x / 10.x.x.x / 172.16.x.x) or a CGNAT IP.
Access is blocked.
Expected Behavior
Private IPs and CGNAT ranges should not be blocked by GeoIP-based rules. Internal clients should be allowed by default or configurable in ACLs without requiring manual exceptions.
Suggestion:
Automatically whitelist RFC1918/RFC6598/RFC4193 ranges in GeoIP evaluations, or provide an explicit setting to treat private/internal IPs separately.
Originally created by @Blacks-Army on GitHub (Jan 12, 2026).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/2239
Originally assigned to: @oschwartz10612 on GitHub.
### Describe the Bug
When using GeoIP-based rules in Pangolin, internal/private IP ranges (LAN and CGNAT) can be unintentionally blocked.
For example, if you create a rule to Bypass Auth for your country with high priority, and then a Block All rule for all countries with lower priority, clients using private IP ranges (192.168.x.x / 10.x.x.x / 172.16.x.x) or CGNAT ranges (100.64.0.0/10) or private ipv6 IP ranges cannot reach the service. This happens because these IPs do not have GeoIP mapping, so the “Block All” rule applies.
### Environment
- OS Type & Version: Docker
- Pangolin Version: latest
- Gerbil Version: latest
- Traefik Version: latest
- Newt Version: latest
- Olm Version: (if applicable)
### To Reproduce
1. Create a rule with Priority 1: Bypass Auth for a specific country (e.g., USA).
2. Create a rule with Priority 2: Block All for all countries.
3. Try accessing the service from a client with a private LAN IP (192.168.x.x / 10.x.x.x / 172.16.x.x) or a CGNAT IP.
4. Access is blocked.
### Expected Behavior
Private IPs and CGNAT ranges should not be blocked by GeoIP-based rules. Internal clients should be allowed by default or configurable in ACLs without requiring manual exceptions.
Suggestion:
Automatically whitelist RFC1918/RFC6598/RFC4193 ranges in GeoIP evaluations, or provide an explicit setting to treat private/internal IPs separately.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @Blacks-Army on GitHub (Jan 12, 2026).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/2239
Originally assigned to: @oschwartz10612 on GitHub.
Describe the Bug
When using GeoIP-based rules in Pangolin, internal/private IP ranges (LAN and CGNAT) can be unintentionally blocked.
For example, if you create a rule to Bypass Auth for your country with high priority, and then a Block All rule for all countries with lower priority, clients using private IP ranges (192.168.x.x / 10.x.x.x / 172.16.x.x) or CGNAT ranges (100.64.0.0/10) or private ipv6 IP ranges cannot reach the service. This happens because these IPs do not have GeoIP mapping, so the “Block All” rule applies.
Environment
To Reproduce
Expected Behavior
Private IPs and CGNAT ranges should not be blocked by GeoIP-based rules. Internal clients should be allowed by default or configurable in ACLs without requiring manual exceptions.
Suggestion:
Automatically whitelist RFC1918/RFC6598/RFC4193 ranges in GeoIP evaluations, or provide an explicit setting to treat private/internal IPs separately.