Private/CGNAT IPs are incorrectly blocked by GeoIP “Block All” rules #386

New Issue

MrUnknownDE · 2026-04-05T17:08:29+02:00

MrUnknownDE commented

2026-04-05 17:08:29 +02:00

Originally created by @Blacks-Army on 1/12/2026

Describe the Bug

When using GeoIP-based rules in Pangolin, internal/private IP ranges (LAN and CGNAT) can be unintentionally blocked.

For example, if you create a rule to Bypass Auth for your country with high priority, and then a Block All rule for all countries with lower priority, clients using private IP ranges (192.168.x.x / 10.x.x.x / 172.16.x.x) or CGNAT ranges (100.64.0.0/10) or private ipv6 IP ranges cannot reach the service. This happens because these IPs do not have GeoIP mapping, so the “Block All” rule applies.

Environment

OS Type & Version: Docker
Pangolin Version: latest
Gerbil Version: latest
Traefik Version: latest
Newt Version: latest
Olm Version: (if applicable)

To Reproduce

Create a rule with Priority 1: Bypass Auth for a specific country (e.g., USA).
Create a rule with Priority 2: Block All for all countries.
Try accessing the service from a client with a private LAN IP (192.168.x.x / 10.x.x.x / 172.16.x.x) or a CGNAT IP.
Access is blocked.

Expected Behavior

Private IPs and CGNAT ranges should not be blocked by GeoIP-based rules. Internal clients should be allowed by default or configurable in ACLs without requiring manual exceptions.

Suggestion:
Automatically whitelist RFC1918/RFC6598/RFC4193 ranges in GeoIP evaluations, or provide an explicit setting to treat private/internal IPs separately.

*Originally created by @Blacks-Army on 1/12/2026* ### Describe the Bug When using GeoIP-based rules in Pangolin, internal/private IP ranges (LAN and CGNAT) can be unintentionally blocked. For example, if you create a rule to Bypass Auth for your country with high priority, and then a Block All rule for all countries with lower priority, clients using private IP ranges (192.168.x.x / 10.x.x.x / 172.16.x.x) or CGNAT ranges (100.64.0.0/10) or private ipv6 IP ranges cannot reach the service. This happens because these IPs do not have GeoIP mapping, so the “Block All” rule applies. ### Environment - OS Type & Version: Docker - Pangolin Version: latest - Gerbil Version: latest - Traefik Version: latest - Newt Version: latest - Olm Version: (if applicable) ### To Reproduce 1. Create a rule with Priority 1: Bypass Auth for a specific country (e.g., USA). 2. Create a rule with Priority 2: Block All for all countries. 3. Try accessing the service from a client with a private LAN IP (192.168.x.x / 10.x.x.x / 172.16.x.x) or a CGNAT IP. 4. Access is blocked. ### Expected Behavior Private IPs and CGNAT ranges should not be blocked by GeoIP-based rules. Internal clients should be allowed by default or configurable in ACLs without requiring manual exceptions. Suggestion: Automatically whitelist RFC1918/RFC6598/RFC4193 ranges in GeoIP evaluations, or provide an explicit setting to treat private/internal IPs separately.

MrUnknownDE added the needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating labels 2026-04-05 17:08:29 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#386