Bypass Rules work only with Path and not IP or IP Range #1476

New Issue

MrUnknownDE · 2026-04-05T19:30:12+02:00

MrUnknownDE commented

2026-04-05 19:30:12 +02:00

Originally created by @dpurnam on 5/17/2025

Thank you very much for such a great thing.

I've been testing Pangolin in an attempt to shift away from Cloudflare Tunnels.

Using the Target Rules based on IP Address (IPv4 or IPv6 - single or ranges) does not work.

However, the Target Rules based on path (for ex. /api/*) works fine on the same target, but this is a lot less secure than those based on IP addresses.

Debug logs:
2025-05-17T10:59:20.437Z [debug]: Verify session: Badger sent {"sessions":{},"originalRequestURL":"https://certs.example.com/","scheme":"","host":"certs.example.com","path":"/","method":"GET","tls":true,"requestIp":"[<correct-public-ipv6-host2>]:51002","headers":{"Accept":"*/*","User-Agent":"curl/7.88.1","X-Forwarded-Host":"certs.example.com","X-Forwarded-Port":"443","X-Forwarded-Proto":"https","X-Forwarded-Server":"amdvpn","X-Real-Ip":"<correct-public-ipv6-host2>"}} 2025-05-17T10:59:20.440Z [debug]: No more auth to check, resource not allowed 2025-05-17T10:59:20.440Z [debug]: {"data":{"valid":false,"redirectUrl":"https://pangolin.example.org/auth/resource/10?redirect=https%3A%2F%2Fcerts.example.com%2F"},"success":true,"error":false,"message":"Access denied","status":200} 2025-05-17T10:59:23.995Z [debug]: Verify session: Badger sent {"sessions":{},"originalRequestURL":"https://certs.example.com/","scheme":"","host":"certs.example.com","path":"/","method":"GET","tls":true,"requestIp":"[<correct-public-ipv6-host1>]:45430","headers":{"Accept":"*/*","User-Agent":"curl/7.88.1","X-Forwarded-Host":"certs.example.com","X-Forwarded-Port":"443","X-Forwarded-Proto":"https","X-Forwarded-Server":"amdvpn","X-Real-Ip":"<correct-public-ipv6-host1>"}} 2025-05-17T10:59:23.996Z [debug]: No more auth to check, resource not allowed 2025-05-17T10:59:23.996Z [debug]: {"data":{"valid":false,"redirectUrl":"https://pangolin.domain.com/auth/resource/10?redirect=https%3A%2F%2Fcerts.example.com%2F"},"success":true,"error":false,"message":"Access denied","status":200}

I did not use the installer but a manual docker compose and using HOST docker network_mode because using user mode pangolin network kept causing DNS 53 errors.

#networks:
#  default:
#    driver: bridge
#    name: pangolin
services:
  pangolin:
    image: fosrl/pangolin:latest
    container_name: pangolin
    network_mode: host
    restart: unless-stopped
    volumes:
      - ./config:/app/config
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3001/api/v1/"]
      interval: "3s"
      timeout: "3s"
      retries: 15

  gerbil:
    image: fosrl/gerbil:latest
    container_name: gerbil
    network_mode: host
    restart: unless-stopped
    depends_on:
      pangolin:
        condition: service_healthy
    command:
      - --reachableAt=http://gerbil:3003
      - --generateAndSaveKeyTo=/var/config/key
      - --remoteConfig=http://pangolin:3001/api/v1/gerbil/get-config
      - --reportBandwidthTo=http://pangolin:3001/api/v1/gerbil/receive-bandwidth
    volumes:
      - ./config/:/var/config
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
#    ports:
#      - 41820:41820/udp
#      - 443:443/tcp # Port for traefik because of the network_mode
#      - 80:80 # Port for traefik because of the network_mode
#      - 443:443/udp # HTTP3/QUIC

  traefik:
    image: traefik:latest #v3.3.3
    container_name: traefik
    restart: unless-stopped
#    network_mode: host
    network_mode: service:gerbil # Ports appear on the gerbil service
    depends_on:
      pangolin:
        condition: service_healthy
    command:
      - --configFile=/etc/traefik/traefik_config.yml
    # Add the environment variables for your DNS provider.
    environment:
      CLOUDFLARE_DNS_API_TOKEN: "MyToken"

    volumes:
      - ./config/traefik:/etc/traefik:ro # Volume to store the Traefik configuration
      - ./config/letsencrypt:/letsencrypt # Volume to store the Let's Encrypt certificates
      #- ./config/traefik/rules:/rules # Non-functional/Breaking mount point from Middleware Manager container

gerbil section in config.yml

gerbil:
  start_port: 41820
#  base_endpoint: "localhost"
  use_subdomain: true
  base_endpoint: "pangolin.domain.com"
#  use_subdomain: false
  block_size: 24
  site_block_size: 30
  subnet_group: 100.89.137.0/20

I feel it's some wrong configuration somewhere, I'm unable to figure out.

*Originally created by @dpurnam on 5/17/2025* Thank you very much for such a great thing. I've been testing Pangolin in an attempt to shift away from Cloudflare Tunnels. Using the Target Rules **based on IP Address** (IPv4 or IPv6 - single or ranges) does not work. However, the Target Rules based **on path** (for ex. /api/*) works fine on the same target, but this is _a lot less secure_ than those based on IP addresses. Debug logs: `2025-05-17T10:59:20.437Z [debug]: Verify session: Badger sent {"sessions":{},"originalRequestURL":"https://certs.example.com/","scheme":"","host":"certs.example.com","path":"/","method":"GET","tls":true,"requestIp":"[<correct-public-ipv6-host2>]:51002","headers":{"Accept":"*/*","User-Agent":"curl/7.88.1","X-Forwarded-Host":"certs.example.com","X-Forwarded-Port":"443","X-Forwarded-Proto":"https","X-Forwarded-Server":"amdvpn","X-Real-Ip":"<correct-public-ipv6-host2>"}} 2025-05-17T10:59:20.440Z [debug]: No more auth to check, resource not allowed 2025-05-17T10:59:20.440Z [debug]: {"data":{"valid":false,"redirectUrl":"https://pangolin.example.org/auth/resource/10?redirect=https%3A%2F%2Fcerts.example.com%2F"},"success":true,"error":false,"message":"Access denied","status":200} 2025-05-17T10:59:23.995Z [debug]: Verify session: Badger sent {"sessions":{},"originalRequestURL":"https://certs.example.com/","scheme":"","host":"certs.example.com","path":"/","method":"GET","tls":true,"requestIp":"[<correct-public-ipv6-host1>]:45430","headers":{"Accept":"*/*","User-Agent":"curl/7.88.1","X-Forwarded-Host":"certs.example.com","X-Forwarded-Port":"443","X-Forwarded-Proto":"https","X-Forwarded-Server":"amdvpn","X-Real-Ip":"<correct-public-ipv6-host1>"}} 2025-05-17T10:59:23.996Z [debug]: No more auth to check, resource not allowed 2025-05-17T10:59:23.996Z [debug]: {"data":{"valid":false,"redirectUrl":"https://pangolin.domain.com/auth/resource/10?redirect=https%3A%2F%2Fcerts.example.com%2F"},"success":true,"error":false,"message":"Access denied","status":200} ` I did not use the installer but a manual docker compose and using HOST docker network_mode because using user mode pangolin network kept causing DNS 53 errors. ``` #networks: # default: # driver: bridge # name: pangolin services: pangolin: image: fosrl/pangolin:latest container_name: pangolin network_mode: host restart: unless-stopped volumes: - ./config:/app/config healthcheck: test: ["CMD", "curl", "-f", "http://localhost:3001/api/v1/"] interval: "3s" timeout: "3s" retries: 15 gerbil: image: fosrl/gerbil:latest container_name: gerbil network_mode: host restart: unless-stopped depends_on: pangolin: condition: service_healthy command: - --reachableAt=http://gerbil:3003 - --generateAndSaveKeyTo=/var/config/key - --remoteConfig=http://pangolin:3001/api/v1/gerbil/get-config - --reportBandwidthTo=http://pangolin:3001/api/v1/gerbil/receive-bandwidth volumes: - ./config/:/var/config cap_add: - NET_ADMIN - SYS_MODULE # ports: # - 41820:41820/udp # - 443:443/tcp # Port for traefik because of the network_mode # - 80:80 # Port for traefik because of the network_mode # - 443:443/udp # HTTP3/QUIC traefik: image: traefik:latest #v3.3.3 container_name: traefik restart: unless-stopped # network_mode: host network_mode: service:gerbil # Ports appear on the gerbil service depends_on: pangolin: condition: service_healthy command: - --configFile=/etc/traefik/traefik_config.yml # Add the environment variables for your DNS provider. environment: CLOUDFLARE_DNS_API_TOKEN: "MyToken" volumes: - ./config/traefik:/etc/traefik:ro # Volume to store the Traefik configuration - ./config/letsencrypt:/letsencrypt # Volume to store the Let's Encrypt certificates #- ./config/traefik/rules:/rules # Non-functional/Breaking mount point from Middleware Manager container ``` gerbil section in config.yml ``` gerbil: start_port: 41820 # base_endpoint: "localhost" use_subdomain: true base_endpoint: "pangolin.domain.com" # use_subdomain: false block_size: 24 site_block_size: 30 subnet_group: 100.89.137.0/20 ``` I feel it's some wrong configuration somewhere, I'm unable to figure out.

MrUnknownDE closed this issue

2026-04-05 19:30:12 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating potential bug potential bug potential bug potential bug potential bug potential bug potential bug potential bug potential bug potential bug

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#1476