mirror of
https://github.com/fosrl/pangolin.git
synced 2026-05-12 00:41:24 -05:00
GeoIP Country Block rules prevent application of configured Authentication Methods #730
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/pangolin#730
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @grizzlycode on GitHub (Oct 19, 2025).
Describe the Bug
When a resource is successfully protected by a standard authentication method and the new GeoIP Country Block rules are simultaneously enabled for that same resource, the existing authentication method ceases to function or appears to be completely bypassed.
The resource becomes accessible without the required authentication check, or the authentication flow simply fails when the GeoIP rules are active. Disabling the GeoIP rules immediately restores the expected authentication functionality, strongly suggesting a conflict or an incorrect priority sequencing between the GeoIP middleware and the authentication middleware.
This issue was observed using a simple GeoIP rule configuration: Allow traffic from the United States (US) and Block all other countries.
Environment
To Reproduce
Steps to reproduce the observed behavior:
Prerequisite: Configure a resource to use a standard authentication method. Verify that access to the resource is successfully gated by this authentication.
Navigate to the Rules tab configuration panel for this specific, authenticated resource.
Enable the rules
Configure a simple rule set (e.g., Allow US and Block All Others).
Save and apply the settings.
Attempt to access the protected resource.
Observed Result: While the country blocking works. The previously functional authentication methods are now disabled or bypassed, allowing unauthorized access or failing the intended auth flow.
Expected Behavior
The GeoIP Country Block rules should apply before or in conjunction with the configured authentication methods. Enabling the GeoIP rules should not interfere with or disable existing applied security features like authentication. All security features should work simultaneously and correctly when rules are enabled.
@txwgnd commented on GitHub (Oct 19, 2025):
This seems to be a duplicate of #1679
@grizzlycode commented on GitHub (Oct 19, 2025):
So I guess I missed issue 1679 which is a similar issue to mine.
The "Pass to Auth" action was a very helpful observation in that thread.
I've tested the suggested solution and can confirm that changing the action to "Pass to Auth" in my ruleset achieves the desired behavior: applying my resource authentication options while simultaneously enforcing the geoblock for unauthorized countries.
If this is the intended configuration, I would strongly recommend expanding the geoblock documentation. Specifically, it would be beneficial to:
This small clarification in the documentation would significantly help users avoid configuration errors and clearly understand the flow of access control.
You may close this issue and continue to work on 1679 since its similar.
@grizzlycode commented on GitHub (Oct 19, 2025):
One quick question on Geoblock does deny all countries include IPs that may not have a country assigned?
@grizzlycode commented on GitHub (Oct 19, 2025):
After rereading the docs, I think this one is on me. Keep up the good work.
https://docs.pangolin.net/manage/geoblocking