I would really appreciate if it had the feature to create rules for MAC Addresses. In my specific use case, I would like to serve internal servers only to specific devices, regardless the network it is.
Proposed Feature
Add support for MAC address rules, which can be used to allow or deny specific devices or vendors.
Benefits
More strict security rules for roaming devices to access protected services, without the need to handle dynamic IPs for each one of them.
Can deny access for specific vendors or devices if needed to. An example could be a specific device (like an AP) in the internal network, or a potential attacker
Originally created by @0-9194 on GitHub (Aug 12, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/1258
I would really appreciate if it had the feature to create rules for MAC Addresses. In my specific use case, I would like to serve internal servers only to specific devices, regardless the network it is.
Proposed Feature
---
Add support for MAC address rules, which can be used to allow or deny specific devices or vendors.
Benefits
---
- More strict security rules for roaming devices to access protected services, without the need to handle dynamic IPs for each one of them.
- Can deny access for specific vendors or devices if needed to. An example could be a specific device (like an AP) in the internal network, or a potential attacker
@Pallavikumarimdb commented on GitHub (Aug 12, 2025):
Hi @0-9194 , Adding support for MAC address rules isn't feasible for Pangolin because MAC addresses only exist within local network segments and don't travel over the internet or through tunnels.
When a device connects to Pangolin from an external network, its MAC address is stripped at the local router. Pangolin receives requests over encrypted tunnels and has no way of seeing the original device's MAC address.
Alternative approach for access control you can try:
User-Based Access Control: Create specific groups or roles in your identity provider for users of these devices. Pangolin can be configured to only allow access to certain services for members of those roles.
<!-- gh-comment-id:3179942262 -->
@Pallavikumarimdb commented on GitHub (Aug 12, 2025):
Hi @0-9194 , Adding support for MAC address rules isn't feasible for Pangolin because MAC addresses only exist within local network segments and don't travel over the internet or through tunnels.
When a device connects to Pangolin from an external network, its MAC address is stripped at the local router. Pangolin receives requests over encrypted tunnels and has no way of seeing the original device's MAC address.
#### Alternative approach for access control you can try:
* **User-Based Access Control**: Create specific groups or roles in your identity provider for users of these devices. Pangolin can be configured to only allow access to certain services for members of those roles.
@oschwartz10612 commented on GitHub (Aug 13, 2025):
I think @Pallavikumarimdb is right on this one. While it could make sense if everything was on the same network when things are not in most use cases the MAC starts to not make a lot of sense.
I appreciate the request but I think we might close this for now!
<!-- gh-comment-id:3182062226 -->
@oschwartz10612 commented on GitHub (Aug 13, 2025):
I think @Pallavikumarimdb is right on this one. While it could make sense if everything was on the same network when things are not in most use cases the MAC starts to not make a lot of sense.
I appreciate the request but I think we might close this for now!
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @0-9194 on GitHub (Aug 12, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/1258
I would really appreciate if it had the feature to create rules for MAC Addresses. In my specific use case, I would like to serve internal servers only to specific devices, regardless the network it is.
Proposed Feature
Add support for MAC address rules, which can be used to allow or deny specific devices or vendors.
Benefits
@Pallavikumarimdb commented on GitHub (Aug 12, 2025):
Hi @0-9194 , Adding support for MAC address rules isn't feasible for Pangolin because MAC addresses only exist within local network segments and don't travel over the internet or through tunnels.
When a device connects to Pangolin from an external network, its MAC address is stripped at the local router. Pangolin receives requests over encrypted tunnels and has no way of seeing the original device's MAC address.
Alternative approach for access control you can try:
@oschwartz10612 commented on GitHub (Aug 13, 2025):
I think @Pallavikumarimdb is right on this one. While it could make sense if everything was on the same network when things are not in most use cases the MAC starts to not make a lot of sense.
I appreciate the request but I think we might close this for now!
@oschwartz10612 commented on GitHub (Aug 13, 2025):
Do you use Pangolin with everything on the same LAN?