Feature Request: Add Region-Based IP Access Control #1274

New Issue

MrUnknownDE · 2026-04-05T18:42:29+02:00

MrUnknownDE commented

2026-04-05 18:42:29 +02:00

Originally created by @Nick390 on 7/5/2025

First, thank you for this fantastic project. I’ve previously tried building similar tunnel solutions, and it would have taken five different tools to achieve what you've done with Pinglin. Impressive work.

Now to the request:

I'd like to suggest a feature that allows region-based IP access control. Specifically, it would be great if administrators could specify allowed countries or regions so that only IPs from those areas are granted access through the tunnel.

Because IPs frequently change or shuffle across regions (especially in shared hosting or cloud networks), the best implementation would likely be to integrate with a geo-IP database provider, such as:

MaxMind (GeoLite2 or GeoIP2)
IP2Location
DB-IP

💡 How it could work:

On first setup, the user specifies allowed countries (e.g., SA, US, DE).
The tool fetches the IP ranges for those countries from the chosen provider.
These IP ranges are then written to the traffic allowlist (e.g., traefik, iptables, or internal ACL).
A scheduled sync updates the list monthly or on a configurable interval.
Optionally, users could select the provider (MaxMind, DB-IP, etc.) via config.

✅ Benefits:

Clean country-level access control
Works great for compliance and internal tools
Improves security posture for sensitive tunnels

Would be happy to contribute or assist with implementation or design if needed.

Thanks again for the amazing work.

*Originally created by @Nick390 on 7/5/2025* First, thank you for this fantastic project. I’ve previously tried building similar tunnel solutions, and it would have taken five different tools to achieve what you've done with Pinglin. Impressive work. Now to the request: I'd like to suggest a feature that allows **region-based IP access control**. Specifically, it would be great if administrators could specify allowed countries or regions so that only IPs from those areas are granted access through the tunnel. Because IPs frequently change or shuffle across regions (especially in shared hosting or cloud networks), the best implementation would likely be to **integrate with a geo-IP database provider**, such as: * MaxMind (GeoLite2 or GeoIP2) * IP2Location * DB-IP ### 💡 How it could work: * On first setup, the user specifies allowed countries (e.g., SA, US, DE). * The tool fetches the IP ranges for those countries from the chosen provider. * These IP ranges are then written to the traffic allowlist (e.g., `traefik`, `iptables`, or internal ACL). * A scheduled sync updates the list monthly or on a configurable interval. * Optionally, users could select the provider (MaxMind, DB-IP, etc.) via config. ### ✅ Benefits: * Clean country-level access control * Works great for compliance and internal tools * Improves security posture for sensitive tunnels Would be happy to contribute or assist with implementation or design if needed. Thanks again for the amazing work.

MrUnknownDE closed this issue

2026-04-05 18:42:29 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#1274