GeoIP Country Block rules prevent application of configured Authentication Methods #753

New Issue

MrUnknownDE · 2026-04-05T17:39:05+02:00

MrUnknownDE commented

2026-04-05 17:39:05 +02:00

Originally created by @grizzlycode on 10/19/2025

Describe the Bug

When a resource is successfully protected by a standard authentication method and the new GeoIP Country Block rules are simultaneously enabled for that same resource, the existing authentication method ceases to function or appears to be completely bypassed.

The resource becomes accessible without the required authentication check, or the authentication flow simply fails when the GeoIP rules are active. Disabling the GeoIP rules immediately restores the expected authentication functionality, strongly suggesting a conflict or an incorrect priority sequencing between the GeoIP middleware and the authentication middleware.

This issue was observed using a simple GeoIP rule configuration: Allow traffic from the United States (US) and Block all other countries.

Environment

OS Type & Version: Ubuntu 24.04
Pangolin Version: 1.11.0
Gerbil Version: 1.2.2
Traefik Version: 3.5.3
Newt Version: 1.5.2

To Reproduce

Steps to reproduce the observed behavior:

Prerequisite: Configure a resource to use a standard authentication method. Verify that access to the resource is successfully gated by this authentication.

Navigate to the Rules tab configuration panel for this specific, authenticated resource.

Enable the rules

Configure a simple rule set (e.g., Allow US and Block All Others).

Save and apply the settings.

Attempt to access the protected resource.

Observed Result: While the country blocking works. The previously functional authentication methods are now disabled or bypassed, allowing unauthorized access or failing the intended auth flow.

Expected Behavior

The GeoIP Country Block rules should apply before or in conjunction with the configured authentication methods. Enabling the GeoIP rules should not interfere with or disable existing applied security features like authentication. All security features should work simultaneously and correctly when rules are enabled.

*Originally created by @grizzlycode on 10/19/2025* ### Describe the Bug When a resource is successfully protected by a standard authentication method and the new GeoIP Country Block rules are simultaneously enabled for that same resource, the existing authentication method ceases to function or appears to be completely bypassed. The resource becomes accessible without the required authentication check, or the authentication flow simply fails when the GeoIP rules are active. Disabling the GeoIP rules immediately restores the expected authentication functionality, strongly suggesting a conflict or an incorrect priority sequencing between the GeoIP middleware and the authentication middleware. This issue was observed using a simple GeoIP rule configuration: Allow traffic from the United States (US) and Block all other countries. ### Environment - OS Type & Version: Ubuntu 24.04 - Pangolin Version: 1.11.0 - Gerbil Version: 1.2.2 - Traefik Version: 3.5.3 - Newt Version: 1.5.2 ### To Reproduce Steps to reproduce the observed behavior: Prerequisite: Configure a resource to use a standard authentication method. Verify that access to the resource is successfully gated by this authentication. Navigate to the Rules tab configuration panel for this specific, authenticated resource. Enable the rules Configure a simple rule set (e.g., Allow US and Block All Others). Save and apply the settings. Attempt to access the protected resource. Observed Result: While the country blocking works. The previously functional authentication methods are now disabled or bypassed, allowing unauthorized access or failing the intended auth flow. ### Expected Behavior The GeoIP Country Block rules should apply before or in conjunction with the configured authentication methods. Enabling the GeoIP rules should not interfere with or disable existing applied security features like authentication. All security features should work simultaneously and correctly when rules are enabled.

MrUnknownDE closed this issue

2026-04-05 17:39:05 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#753