enhance(geo): reduce confusion between setup and usage

This commit is contained in:
Laurence
2026-05-12 16:29:10 +01:00
parent 22e5aa55a0
commit c18640c8ff
11 changed files with 128 additions and 109 deletions
+4 -4
View File
@@ -71,13 +71,13 @@ We use a IP database to geolocate the IP address but this is not always accurate
Select the "ALL" option to match all countries for allowing or denying access.
To enable geoblocking, follow this guide to set up the geolocation database: [Geoblocking Guide](/self-host/advanced/enable-geoblocking).
To use country rules, follow this guide to set up the geolocation database: [Enable Geo-location](/self-host/advanced/enable-geolocation).
### Region
Region match rules allow you to specify allowed or denied regions for requests based on their IP address. This is useful for geo-restrictions or compliance with regional regulations. Regions are made up of a list of countries in that region (e.g. "EU" includes France, Germany, etc.) so this is a more broad match than country.
To enable follow the above guide to set up the geolocation database: [Geoblocking Guide](/self-host/advanced/enable-geoblocking).
To use region rules, follow this guide to set up the geolocation database: [Enable Geo-location](/self-host/advanced/enable-geolocation).
### CIDR
@@ -102,7 +102,7 @@ Pretty simple: you can match on simply an IP address like your home IP to bypass
ASN (Autonomous System Number) match rules allow you to specify allowed or denied ASNs for requests based on their IP address. This is useful for blocking or allowing traffic from specific ISPs or organizations.
To enable ASN blocking, follow this guide to set up the ASN database: [ASN Blocking Guide](/self-host/advanced/enable-asnblocking).
To use ASN rules, follow this guide to set up the ASN lookup database: [Enable ASN Lookup](/self-host/advanced/enable-asn-lookup).
**Examples:**
@@ -112,4 +112,4 @@ To enable ASN blocking, follow this guide to set up the ASN database: [ASN Block
### Community Contributed Rules
Some common bypass paths for common self hosted apps can be found [in the community contributed rules](/self-host/community-guides/rules).
Some common bypass paths for common self hosted apps can be found [in the community contributed rules](/self-host/community-guides/rules).
+1 -2
View File
@@ -10,7 +10,7 @@ import PangolinCloudTocCta from "/snippets/pangolin-cloud-toc-cta.mdx";
<Note>
ASN blocking is available in Pangolin community! Protect your resources by blocking or allowing specific networks and service providers.
ASN blocking is available in Pangolin Community Edition. It depends on Pangolin's ASN lookup database. Follow [Enable ASN Lookup](/self-host/advanced/enable-asn-lookup) before creating ASN rules.
</Note>
## Benefits of ASN Blocking
@@ -117,4 +117,3 @@ Identify and block ASNs associated with automated bot traffic:
2. Create **Deny** rules for ASNs showing bot-like behavior
3. Regularly review and update your blocklist
+9 -9
View File
@@ -1,6 +1,6 @@
---
title: "Geo-blocking"
description: "Configure geo blocking to restrict access based on geographic location"
description: "Configure geo-blocking to restrict access based on geographic location"
---
import PangolinCloudTocCta from "/snippets/pangolin-cloud-toc-cta.mdx";
@@ -10,12 +10,12 @@ import PangolinCloudTocCta from "/snippets/pangolin-cloud-toc-cta.mdx";
<Note>
Geoblocking is available in Pangolin community! Make sure to follow this guide for how to enable: [Enabling Geo Blocking](/self-host/advanced/enable-geoblocking)
Geo-blocking is available in Pangolin Community Edition. It depends on Pangolin's geo-location database, which is also used by other location-aware features such as analytics. Follow [Enable Geo-location](/self-host/advanced/enable-geolocation) before creating country or region rules.
</Note>
## Benefits of Geo Blocking
## Benefits of Geo-blocking
Geo blocking provides several important security and compliance advantages:
Geo-blocking provides several important security and compliance advantages:
### Security Benefits
- **Reduce Attack Surface**: Block access from regions with high levels of malicious activity or where you don't expect legitimate users
@@ -23,15 +23,15 @@ Geo blocking provides several important security and compliance advantages:
- **Compliance Requirements**: Meet regulatory requirements that restrict data access based on geographic location
- **Resource Protection**: Prevent unnecessary load on your services from regions where you don't operate
## Implementing Geo Blocking with Bypass Rules
## Implementing Geo-blocking with Bypass Rules
Geo blocking in Pangolin is implemented using [bypass rules](/manage/access-control/rules) with country-based matching. You can create rules that either allow or deny access based on the visitor's country.
Geo-blocking in Pangolin is implemented using [bypass rules](/manage/access-control/rules) with country-based matching. You can create rules that either allow or deny access based on the visitor's country.
<Frame caption="Screenshot of resources rules from the Pangolin Dashboard.">
<img src="/images/country_rules.png" alt="Pangolin Dashboard"/>
</Frame>
### Setting Up Geo Blocking Rules
### Setting Up Geo-blocking Rules
1. Navigate to your target resource and select the **Rules** tab
2. Create a new rule and select **Country** as the match type
@@ -40,7 +40,7 @@ Geo blocking in Pangolin is implemented using [bypass rules](/manage/access-cont
- **Deny**: Block all access from specific countries
- **Pass to Auth**: Let users from specific countries proceed to authentication
### Common Geo Blocking Patterns
### Common Geo-blocking Patterns
#### Allow Only Specific Countries
Create a "Deny" rule that blocks all countries except those you want to allow:
@@ -63,7 +63,7 @@ Create targeted deny rules for specific countries while allowing all others:
3. Set appropriate priorities
#### Regional Access Control
Combine geo blocking with other rule types for sophisticated access control:
Combine geo-blocking with other rule types for sophisticated access control:
1. **Path + Country**: Block admin paths (`/admin/*`) from all countries except your headquarters
2. **IP + Country**: Allow specific IPs from restricted countries (for VPN users or partners)