github-starred/pangolin
2
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-05-06 12:55:03 -05:00
Code Issues 564 Packages Projects Releases 72 Wiki Activity

[PR #2843] Exclude local/private/CGNAT IPs from geo-block rules (fixes issue #2239) #5126

New Issue
Open
opened 2026-04-20 09:16:31 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-20 09:16:31 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/fosrl/pangolin/pull/2843
Author: @Blacks-Army
Created: 4/12/2026
Status: 🔄 Open

Base: dev ← Head: dev

📝 Commits (1)

  • 8e1905a Exclude local/private/CGNAT IPs from COUNTRY=ALL and ASN=ALL/AS0 geo-blocking rules

📊 Changes

1 file changed (+50 additions, -7 deletions)

View changed files

📝 server/routers/badger/verifySession.ts (+50 -7)

📄 Description

Community Contribution License Agreement

By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.

Description

Fixes issue #2239

Disclaimer:
This is my first contribution to Pangolin, so please bear with me 😅

This PR updates geo wildcard rule behavior for non-public source IPs.

  • COUNTRY=ALL with action BLOCK: local/private/CGNAT IPs are skipped
  • ASN=ALL / ASN=AS0 with action BLOCK: local/private/CGNAT IPs are skipped
  • Explicit CIDR / IP rules are unchanged

Why this makes sense:

  • local/private/CGNAT IPs are not meaningfully geolocatable
  • wildcard geo block rules should target public Internet IPs
  • intentional blocking is still possible via CIDR, including:
    • 0.0.0.0/0 (IPv4)
    • ::/0 (IPv6)

How to test?

  1. Add rule COUNTRY=ALL or ASN=ALL, action BLOCK, send request from 192.168.1.10 --> not blocked by this rule.
  2. Add rule CIDR=192.168.0.0/16, action BLOCK --> IP is blocked.
  3. Add rule CIDR=0.0.0.0/0 (or ::/0 for IPv6), action BLOCK -> IP is also blocked.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/fosrl/pangolin/pull/2843 **Author:** [@Blacks-Army](https://github.com/Blacks-Army) **Created:** 4/12/2026 **Status:** 🔄 Open **Base:** `dev` ← **Head:** `dev` --- ### 📝 Commits (1) - [`8e1905a`](https://github.com/fosrl/pangolin/commit/8e1905a695add77d18ca8a2e16cd4c40437bbca9) Exclude local/private/CGNAT IPs from COUNTRY=ALL and ASN=ALL/AS0 geo-blocking rules ### 📊 Changes **1 file changed** (+50 additions, -7 deletions) <details> <summary>View changed files</summary> 📝 `server/routers/badger/verifySession.ts` (+50 -7) </details> ### 📄 Description ## Community Contribution License Agreement By creating this pull request, I grant the project maintainers an unlimited, perpetual license to use, modify, and redistribute these contributions under any terms they choose, including both the AGPLv3 and the Fossorial Commercial license terms. I represent that I have the right to grant this license for all contributed content. ## Description Fixes issue #2239 Disclaimer: This is my first contribution to Pangolin, so please bear with me 😅 This PR updates geo wildcard rule behavior for non-public source IPs. - `COUNTRY=ALL` with action `BLOCK`: local/private/CGNAT IPs are skipped - `ASN=ALL` / `ASN=AS0` with action `BLOCK`: local/private/CGNAT IPs are skipped - Explicit `CIDR` / `IP` rules are unchanged Why this makes sense: - local/private/CGNAT IPs are not meaningfully geolocatable - wildcard geo block rules should target public Internet IPs - intentional blocking is still possible via CIDR, including: - `0.0.0.0/0` (IPv4) - `::/0` (IPv6) ## How to test? 1. Add rule `COUNTRY=ALL` or `ASN=ALL`, action `BLOCK`, send request from `192.168.1.10` --> not blocked by this rule. 2. Add rule `CIDR=192.168.0.0/16`, action `BLOCK` --> IP is blocked. 3. Add rule `CIDR=0.0.0.0/0` (or `::/0` for IPv6), action `BLOCK` -> IP is also blocked. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-20 09:16:31 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
api
authentication
bug
config
dependencies
docker
documentation
enhancement
good first issue
help wanted
Improvement
Look Into
needs investigating
networking
new feature
non-critical bug
potential bug
pull-request
Mirrored from GitHub Pull Request
 question
reverse proxy
Security
stale
ui
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/pangolin#5126
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?