Add ASN-based resource rule matching #480

New Issue

MrUnknownDE · 2026-04-05T17:12:18+02:00

MrUnknownDE commented

2026-04-05 17:12:18 +02:00

Originally created by @WildeTechSolutions on 12/16/2025

Add MaxMind ASN database integration
Implement ASN lookup and matching in resource rule verification
Add curated list of 100+ major ASNs (cloud, ISP, CDN, mobile carriers)
Add ASN dropdown selector in resource rules UI with search functionality
Support custom ASN input for unlisted ASNs
Add 'ALL ASNs' special case handling (AS0)
Cache ASN lookups with 5-minute TTL for performance
Update validation schemas to support ASN match type

This allows administrators to create resource access rules based on Autonomous System Numbers, similar to existing country-based rules. Useful for restricting access by ISP, cloud provider, or mobile carrier.

Community Contribution License Agreement

By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.

Description

The implementation is nearly identical to using the Country rules with the maxmind GeoIP database. This time you just need the GeoLite2-ASN.mmdb next to your GeoLite2-Country.mmdb. Fetching the ASN database is no different from fetching the Country database, and if Pangolin detects it, it will enable the rule capability just like with Country.

Similar to country, a number of popular ASNs are provided in the dropdown by default. This is a great way to reduce unwanted traffic to resources that can't support other Authentication means (i.e. Mobile apps that need api access that don't support custom headers like Amperfy).

How to test?

Add the geoip-updater container to docker-compose.yml.

  geoip-updater:
    image: maxmindinc/geoipupdate:latest
    container_name: geoip-updater
    volumes:
      - ./config/maxmind:/usr/share/GeoIP
    environment:
      GEOIPUPDATE_ACCOUNT_ID: ${GEOIP_ACCOUNT_ID}
      GEOIPUPDATE_LICENSE_KEY: ${GEOIP_LICENSE_KEY}
      GEOIPUPDATE_EDITION_IDS: ${GEOIP_EDITION_IDS}
    restart: on-failure

The GEOIP_EDITION_IDS variable should contain the ASN database:

GEOIP_EDITION_IDS=GeoLite2-Country GeoLite2-City GeoLite2-ASN

Add the maxmind_asn_path variable to the server block in config.yml:

server:
  maxmind_db_path: "./config/maxmind/GeoLite2-Country.mmdb"
  maxmind_asn_path: "./config/maxmind/GeoLite2-ASN.mmdb"

You can now create ASN rules in the same fashion as Country rules, i.e. Bypass Auth for your mobile carrier and Block Access for ALL.

*Originally created by @WildeTechSolutions on 12/16/2025* - Add MaxMind ASN database integration - Implement ASN lookup and matching in resource rule verification - Add curated list of 100+ major ASNs (cloud, ISP, CDN, mobile carriers) - Add ASN dropdown selector in resource rules UI with search functionality - Support custom ASN input for unlisted ASNs - Add 'ALL ASNs' special case handling (AS0) - Cache ASN lookups with 5-minute TTL for performance - Update validation schemas to support ASN match type This allows administrators to create resource access rules based on Autonomous System Numbers, similar to existing country-based rules. Useful for restricting access by ISP, cloud provider, or mobile carrier. ## Community Contribution License Agreement By creating this pull request, I grant the project maintainers an unlimited, perpetual license to use, modify, and redistribute these contributions under any terms they choose, including both the AGPLv3 and the Fossorial Commercial license terms. I represent that I have the right to grant this license for all contributed content. ## Description The implementation is nearly identical to using the Country rules with the maxmind GeoIP database. This time you just need the `GeoLite2-ASN.mmdb` next to your `GeoLite2-Country.mmdb`. Fetching the ASN database is no different from fetching the Country database, and if Pangolin detects it, it will enable the rule capability just like with Country. <img width="2097" height="836" alt="image" src="https://github.com/user-attachments/assets/14ca063a-3b78-4a85-bba8-9a1cdd7af5a2" /> <img width="1903" height="999" alt="image" src="https://github.com/user-attachments/assets/317eace5-901b-45e3-9b64-d3237acfc60b" /> Similar to country, a number of popular ASNs are provided in the dropdown by default. This is a great way to reduce unwanted traffic to resources that can't support other Authentication means (i.e. Mobile apps that need api access that don't support custom headers like Amperfy). ## How to test? Add the `geoip-updater` container to `docker-compose.yml`. ```yml geoip-updater: image: maxmindinc/geoipupdate:latest container_name: geoip-updater volumes: - ./config/maxmind:/usr/share/GeoIP environment: GEOIPUPDATE_ACCOUNT_ID: ${GEOIP_ACCOUNT_ID} GEOIPUPDATE_LICENSE_KEY: ${GEOIP_LICENSE_KEY} GEOIPUPDATE_EDITION_IDS: ${GEOIP_EDITION_IDS} restart: on-failure ``` The `GEOIP_EDITION_IDS` variable should contain the ASN database: ```properties GEOIP_EDITION_IDS=GeoLite2-Country GeoLite2-City GeoLite2-ASN ``` Add the `maxmind_asn_path` variable to the `server` block in `config.yml`: ```yml server: maxmind_db_path: "./config/maxmind/GeoLite2-Country.mmdb" maxmind_asn_path: "./config/maxmind/GeoLite2-ASN.mmdb" ``` You can now create ASN rules in the same fashion as Country rules, i.e. `Bypass Auth` for your mobile carrier and `Block Access` for `ALL`.

MrUnknownDE closed this issue

2026-04-05 17:12:18 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#480