Geo-blocking

Benefits of Geo-blockingCopy Anchor Link

Geo-blocking provides several important security and compliance advantages:

Security BenefitsCopy Anchor Link

• Reduce Attack Surface: Block access from regions with high levels of malicious activity or where you don't expect legitimate users
• Prevent Unauthorized Access: Limit exposure to threat actors operating from specific geographic locations
• Compliance Requirements: Meet regulatory requirements that restrict data access based on geographic location
• Resource Protection: Prevent unnecessary load on your services from regions where you don't operate

Implementing Geo-blocking with Bypass RulesCopy Anchor Link

Geo-blocking in Pangolin is implemented using bypass rules with country-based matching. You can create rules that either allow or deny access based on the visitor's country. To apply the same geo-blocking rules to multiple public resources, define them in a resource policy and attach that policy to each resource.

Setting Up Geo-blocking RulesCopy Anchor Link

1. Navigate to your target resource and select the Rules tab
2. Create a new rule and select Country as the match type
3. Choose your rule action:
   • Allow: Bypass authentication for users from specific countries
   • Deny: Block all access from specific countries
   • Pass to Auth: Let users from specific countries proceed to authentication

Common Geo-blocking PatternsCopy Anchor Link

Allow Only Specific CountriesCopy Anchor Link

Create a "Deny" rule that blocks all countries except those you want to allow:

1. Create a Deny rule
2. Select Country match type
3. Choose "ALL" to match all countries
4. Add priority: 100 (lower priority)

Then create specific allow rules for your approved countries:

1. Create Allow rules for each approved country
2. Set higher priority (e.g., 10, 20, 30) so they process first

Block Specific High-Risk CountriesCopy Anchor Link

Create targeted deny rules for specific countries while allowing all others:

1. Create Deny rules for each country you want to block
2. Select the specific countries from the dropdown
3. Set appropriate priorities

Regional Access ControlCopy Anchor Link

Combine geo-blocking with other rule types for sophisticated access control:

1. Path + Country: Block admin paths (/admin/*) from all countries except your headquarters
2. IP + Country: Allow specific IPs from restricted countries (for VPN users or partners)
3. CIDR + Country: Combine network-based and geography-based restrictions

Best PracticesCopy Anchor Link

Rule Priority ExampleCopy Anchor Link

Priority 1: Allow - Country: United States
Priority 2: Allow - Country: Canada  
Priority 3: Allow - Country: United Kingdom
Priority 4: Deny - Country: ALL

This configuration allows access only from the US, Canada, and UK while blocking all other countries.