Add "location" match type for resource-level geoblocking #1139

New Issue

MrUnknownDE · 2026-04-05T18:21:27+02:00

MrUnknownDE commented

2026-04-05 18:21:27 +02:00

Originally created by @oschwartz10612 on 7/31/2025

Discussed in https://github.com/orgs/fosrl/discussions/769

^{Originally posted by az18 May 22, 2025}

Description

Currently, Pangolin allows rules with match type "ip" for resources. I'd like to propose adding a new match type called "location" that would check if an IP address corresponds to a specific geographical location (country/region), with the standard allow/deny logic we already have in place.

Why is this needed?

This feature would enable granular control over which countries can access specific resources within a Pangolin instance. While the community guide already provides a method for geoblocking at the instance level via Traefik (https://docs.fossorial.io/Community%20Guides/geoblock), implementing this at the resource level would give administrators more fine-grained control.

Implementation details

New match type "location" for resource rules
Would use standard IP geolocation techniques to determine user location
Uses the same allow/deny logic as current IP rules
Could leverage existing geolocation databases to map IP addresses to countries

Benefits

Resource-by-resource control of country/regional access
More flexible security policies
Better control over content distribution based on geographical constraints

Would this be a valuable addition to Pangolin? I'm happy to provide more details if needed.

Example:

*Originally created by @oschwartz10612 on 7/31/2025* ### Discussed in https://github.com/orgs/fosrl/discussions/769 <div type='discussions-op-text'> <sup>Originally posted by **az18** May 22, 2025</sup> ## Description Currently, Pangolin allows rules with match type "ip" for resources. I'd like to propose adding a new match type called "location" that would check if an IP address corresponds to a specific geographical location (country/region), with the standard allow/deny logic we already have in place. ## Why is this needed? This feature would enable granular control over which countries can access specific resources within a Pangolin instance. While the community guide already provides a method for geoblocking at the instance level via Traefik (https://docs.fossorial.io/Community%20Guides/geoblock), implementing this at the resource level would give administrators more fine-grained control. ## Implementation details - New match type "location" for resource rules - Would use standard IP geolocation techniques to determine user location - Uses the same allow/deny logic as current IP rules - Could leverage existing geolocation databases to map IP addresses to countries ## Benefits - Resource-by-resource control of country/regional access - More flexible security policies - Better control over content distribution based on geographical constraints Would this be a valuable addition to Pangolin? I'm happy to provide more details if needed. Example: ![image](https://github.com/user-attachments/assets/2e21d01d-191c-4b07-8d43-c2760ec7a93c) </div>

MrUnknownDE closed this issue

2026-04-05 18:21:27 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#1139