github-starred/pangolin
2
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-05-06 12:55:03 -05:00
Code Issues 480 Packages Projects Releases 72 Wiki Activity

[GH-ISSUE #2239] Private/CGNAT IPs are incorrectly blocked by GeoIP “Block All” rules #6908

New Issue
Open
opened 2026-04-25 15:54:39 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-25 15:54:39 -05:00
Owner
Copy Link

Originally created by @Blacks-Army on GitHub (Jan 12, 2026).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/2239

Originally assigned to: @oschwartz10612 on GitHub.

Describe the Bug

When using GeoIP-based rules in Pangolin, internal/private IP ranges (LAN and CGNAT) can be unintentionally blocked.

For example, if you create a rule to Bypass Auth for your country with high priority, and then a Block All rule for all countries with lower priority, clients using private IP ranges (192.168.x.x / 10.x.x.x / 172.16.x.x) or CGNAT ranges (100.64.0.0/10) or private ipv6 IP ranges cannot reach the service. This happens because these IPs do not have GeoIP mapping, so the “Block All” rule applies.

Environment

  • OS Type & Version: Docker
  • Pangolin Version: latest
  • Gerbil Version: latest
  • Traefik Version: latest
  • Newt Version: latest
  • Olm Version: (if applicable)

To Reproduce

  1. Create a rule with Priority 1: Bypass Auth for a specific country (e.g., USA).
  2. Create a rule with Priority 2: Block All for all countries.
  3. Try accessing the service from a client with a private LAN IP (192.168.x.x / 10.x.x.x / 172.16.x.x) or a CGNAT IP.
  4. Access is blocked.

Expected Behavior

Private IPs and CGNAT ranges should not be blocked by GeoIP-based rules. Internal clients should be allowed by default or configurable in ACLs without requiring manual exceptions.

Suggestion:
Automatically whitelist RFC1918/RFC6598/RFC4193 ranges in GeoIP evaluations, or provide an explicit setting to treat private/internal IPs separately.

Originally created by @Blacks-Army on GitHub (Jan 12, 2026). Original GitHub issue: https://github.com/fosrl/pangolin/issues/2239 Originally assigned to: @oschwartz10612 on GitHub. ### Describe the Bug When using GeoIP-based rules in Pangolin, internal/private IP ranges (LAN and CGNAT) can be unintentionally blocked. For example, if you create a rule to Bypass Auth for your country with high priority, and then a Block All rule for all countries with lower priority, clients using private IP ranges (192.168.x.x / 10.x.x.x / 172.16.x.x) or CGNAT ranges (100.64.0.0/10) or private ipv6 IP ranges cannot reach the service. This happens because these IPs do not have GeoIP mapping, so the “Block All” rule applies. ### Environment - OS Type & Version: Docker - Pangolin Version: latest - Gerbil Version: latest - Traefik Version: latest - Newt Version: latest - Olm Version: (if applicable) ### To Reproduce 1. Create a rule with Priority 1: Bypass Auth for a specific country (e.g., USA). 2. Create a rule with Priority 2: Block All for all countries. 3. Try accessing the service from a client with a private LAN IP (192.168.x.x / 10.x.x.x / 172.16.x.x) or a CGNAT IP. 4. Access is blocked. ### Expected Behavior Private IPs and CGNAT ranges should not be blocked by GeoIP-based rules. Internal clients should be allowed by default or configurable in ACLs without requiring manual exceptions. Suggestion: Automatically whitelist RFC1918/RFC6598/RFC4193 ranges in GeoIP evaluations, or provide an explicit setting to treat private/internal IPs separately.
GiteaMirror added the needs investigating label 2026-04-25 15:54:39 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
api
authentication
bug
config
dependencies
docker
documentation
enhancement
good first issue
help wanted
Improvement
Look Into
needs investigating
networking
new feature
non-critical bug
potential bug
pull-request
Mirrored from GitHub Pull Request
 question
reverse proxy
Security
stale
ui
wontfix
No Label needs investigating
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/pangolin#6908
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?