Pangolin Rules, Allow by path + Allow for Country

[hteasfes]

Hello!

I am attempting to configure rules to meet specific geo-access and authentication requirements, but I am running into a limitation based on how rules are matched.

My Goal: I need to enforce the following hierarchy of access control for my service:

1. Bypass Auth for API paths (/api/*), but only for traffic originating from KZ.
2. Require Authentication (Pass to Auth) for all other traffic (UI, login pages, etc.) from KZ.
3. Completely Reject (Deny) all traffic from all other countries.

The Conflict: Since rules are processed from top to bottom in order of priority, I need to differentiate actions for requests originating from KZ based on the path before the final global Deny Rule executes.

If I set up an Allow Rule based only on Path = /api/, this rule allows all countries to bypass authentication for API access, which violates my requirement to block all non-KZ traffic.
Conversely, if I try to use a Country rule, I cannot separately apply an Allow action to the API path (/api/) while simultaneously requiring a Pass to Auth action for the standard UI paths from the same country (KZ).

Question: If I can't use a compound rule (e.g., Country = KZ AND Path = /api/*), how can I do it in another way? Or is it even possible?😅
I don't want to open my API to the whole world :\

[Toastienergy]

Just found this because I have the same problem. Did you find any solution?

[k18ldp]

Following

[Toastienergy]

I used this guide and it's working perfectly.
Also protects the pangolin dashboard.

https://forum.hhf.technology/t/implementing-geoblocking-in-pangolin-stack-with-traefik/490

[timokluser-dev]

any update on this @oschwartz10612

[hanjo]

Actually with the release of v1.20.0 the exact use case described is now possible by using the Country Is Not matching type - just block any country not being KZ first and implement the other rules afterwards.

However, this does not solve the underlying issues that the rules are somewhat limited. For example, if you would like to allow two countries instead of just one, there is still no possibility to do so. Therefore, proper logic (i.e. NOT, AND, OR, maybe XOR and Parentheses) would still be immensily helpful.