---
title: "Rules"
description: "Configure rules to allow or deny access to resources without authentication"
---

Rules allow you to either "allow" and bypass the Pangolin auth system (no pin, login, password), or "deny" and fully reject the request. After you create a resource you can select the "Rules" tab on the sidebar and enable rules.

<CardGroup cols={2}>
<Card title="Allow Rules" icon="check">
  Bypass authentication completely for matching requests. Users can access resources without any login or PIN.
</Card>

<Card title="Deny Rules" icon="x">
  Completely reject requests that match the rule. Useful for blocking admin paths or sensitive endpoints.
</Card>

<Card title="Pass to Auth" icon="x">
  Pass requests that match the rule to the next stage for user to authenticate with SSO, password, or pin. Useful for enforcing auth on specific paths while allowing others.
</Card>
</CardGroup>

## Types of Rules

Rules are processed from top to bottom in order of their priority. This means you can have multiple rules to bypass auth and to just flat deny users at the end.

Right now you can match on the following items:

### Path

Path match rules allow URL patterns defined with plain text and wildcards (`*`) that match any characters. Patterns and URLs are split into segments (using `/`), and **each segment is matched individually**.

#### Examples:

- `blog/posts`  
  Matches the exact path `/blog/posts`.

- `blog/*`  
  Matches any path under `/blog` (e.g., `/blog/travel`).

- `*/2023/*`  
  Matches paths with `/2023/` as a middle segment (e.g., `/news/2023/summary`).

- `article*`  
  Matches **segments** starting with "article" (e.g., `/article-123`).

- `*admin*`  
  Matches **segments** containing "admin" (e.g., `/my-admin-panel`).

- `personal-*/*`  
  Matches paths where the first segment starts with `personal-` and is followed by any segment (e.g., `/personal-blog/post`).

#### Segment-by-Segment Matching

- **Normalization:**  
  Both patterns and URLs are split into segments. For example, `/blog/journal/entry` becomes `["blog", "journal", "entry"]`, while `/blog*` becomes `["blog*"]`.

- **Validation:**  
  Each pattern segment must correspond to a URL segment, and wildcards match zero or more characters within that segment. A pattern like `/blog*` only matches the first segment, so URLs with extra segments require additional placeholders (e.g., `/blog*/*`).

### Country

<Note>
Geo blocking is only available for targets created with managed self-hosted nodes or in the cloud because we need to host services to resolve IP addresses and evolve it quickly as network change.

Fully self hosted users can install a [Traefik plugin](/self-host/community-guides/geoblock) for geo blocking support.
</Note>

Country match rules allow you to specify allowed or denied countries for requests based on their IP address. This is useful for geo-restrictions or compliance with regional regulations.

We use a IP database to geolocate the IP address but this is not always accurate. We try to keep it updated, but there may be cases where the location is incorrect.

Select the "ALL" option to match all countries for allowing or denying access.

### CIDR

CIDR (Classless Inter-Domain Routing) notation specifies IP address ranges using an IP address and a network prefix length. The format is [IP address]/[prefix length].

**Examples:**

- `144.234.11.22/24` - Matches all 256 IPs from 192.168.1.0 to 192.168.1.255
- `10.0.0.0/8` - Matches any IP starting with 10 (16.7 million addresses)
- `2001:db8::/32` - Matches a range of IPv6 addresses
- `0.0.0.0/0` - Matches all IPv4 addresses

<Note>
The prefix length (1-32 for IPv4, 1-128 for IPv6) determines how many bits from the left are fixed. Smaller prefix numbers match larger ranges.
</Note>

### IP

Pretty simple: you can match on simply an IP address like your home IP to bypass auth. This is the same as entering a /32 CIDR.

**Examples:**

- `23.234.134.32`
- `34.45.245.64`
- `192.168.1.1`

## Rules for Specific Apps

This table compiles paths that need to be allowed for various apps to work with Pangolin authentication.

| App                              | Required Bypass Rules                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| -------------------------------- |   |
| **Media Management**             |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| Radarr                           | `/api/*`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| Sonarr                           | `/api/*`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| Lidarr                           | `/api/*`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |      
| **Media Servers**                |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| Jellyfin (iOS)                   | `/system/info/public`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| Jellyfin (Roku)                  | `/System/Info/Public`<br />`/Users/AuthenticateByName`<br />`/Users/Public`<br />`/QuickConnect/Initiate`<br />`/QuickConnect/Connect`<br />`/Users/AuthenticateWithQuickConnect`                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| Audiobookshelf (Android)         | `/api/*`<br />`/login*`<br />`/s/*`<br />`/ping*`<br />`/feed/*`<br />`/socket*`<br />`/status`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | 
| **Management & Monitoring**      |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| Tautulli                         | `/api/*`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| Harbour                          | `/api/*`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| Hoarder App                      | `/api/*`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| Uptime Kuma Manager              | `/api/*`<br />`/socket.io/*`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
| Beszel                           | `/api/beszel/agent-connect`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| MeshCentral                      | `/api/*`<br />`/meshrelay.ashx`<br />`/agent.ashx`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
| **Security & Privacy**           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| AdGuard Home                     | `/api/*`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| Ente Auth                        | `*api*`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| Vaultwarden/Bitwarden            | `/api/*`<br />`/identity/*`<br />`/wl/*`<br />Always Deny - Path - `/admin/*`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| **Cloud & Sync**                 |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| Nextcloud                        | `/` (Main interface)<br />`/index.php` (Core handler)<br />`/remote.php` (Remote access)<br />`/status.php` (Status checks)<br />`/ocs` (Collaboration Services API)<br />`/apps` (Applications)<br />`/remote.php/webdav` (WebDAV endpoint)<br />`/remote.php/dav` (CalDAV/CardDAV)<br />`/remote.php/caldav` (Calendar sync)<br />`/remote.php/carddav` (Contacts sync)<br />`/ocs/v1.php` (API endpoints)<br />`/ocs/v2.php` (API v2 endpoints)<br />`/login` (Authentication)<br />`/.well-known/*` (Service discovery)<br />`/.well-known/webfinger` (WebFinger protocol)<br />`/s/*` (Shared files/folders) |
| Onlyoffice                       | `/cache/*`<br />`*/CommandService.ashx`<br />`*/converter/*`<br />`*/doc/*`<br />`*/downloadas/*`<br />`/downloadfile/*`<br />`*/fonts/*`<br />`/healthcheck`<br />`/methodology/*`<br />`*/plugins.json`<br />`*/sdkjs/*`<br />`*/sdkjs-plugins/*`<br />`*/themes.json`<br />`*/web-apps/*`
| **Photo Management**             |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| Ente Photos                      | `*api*`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| Immich                           | `/api/*`<br />`/.well-known/immich`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| **File Management**              |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| Filebrowser                      | `/static/*`<br />`/share/*` <br/> `/api/public/dl/*` <br/> `/api/public/share/*`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| **Notes & Knowledge Management** |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| Joplin Notes Server              | `/api/*`<br />`/shares/*`<br />`/css/*`<br />`/images/*`<br />Always Deny - Path - `/login/*` (optional)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| Erugo                            | `/api/*`<br />`/shares/*`<br />`/build/*`<br />`/get-logo`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
| Memos                            | `/api/*`<br />`/assets/*`<br />`/explore*`<br />`/memos.api.v1.*`<br />`/auth/callback*`<br />`/auth`<br />`/site.webmanifest`<br />`/logo.webp`<br />`/full-logo.webp`<br />`/android-chrome-192x192.png`                                                                                                                                                                                                                                                                                                                                                                                                    |
| Linkding                          | `/api/*`<br />`/bookmarks/*`<br />Always Deny - Path - `/admin/*`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
| **Communication**                |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| Matrix/Synapse (Clients)         | `/_matrix/*`<br />`/_synapse/client/*`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
| Matrix/Synapse (Federation)      | `/_matrix/*`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
| **Notifications**                |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| Gotify                           | `/version`<br />`/message`<br />`/application`<br />`/client`<br />`/stream`<br />`/plugin`<br />`/health`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
| **Home Automation**              |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| Home Assistant                   | `/api/*`<br />`/auth/*`<br />`/frontend_latest/*`<br />`/lovelace*`<br />`/static/*`<br />`/hacsfile/*`<br />`/local/*`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| n8n                              | `/webhook-test/*/webhook`<br />`/webhook/*/webhook`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| **Project Management**              |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| Jetbrains Youtrack                   | `/api/*`<br />`/hub/api/*`<br />                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| **Genealogy**                        |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| Gramps Web                           | `/api/*`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |

<Note>
These rules are examples and may need to be adjusted based on your specific app configuration and version.
</Note>
