`country is not` access rule doesn't allow multiple countries

[MohamedElashri]

Describe the Bug

The country is not feature in the latest pangolin version is useful but it is limited. In one rule we cannot add multiple countries and if we add more than one rule for multiple countries then only the first one is active. This should ideally change in behavior or at least be documented.

Environment

• OS Type & Version: Debian 6.12.57-1
• Pangolin Version: 1.20.0
• Edition (Community or Enterprise): Enterprise (free homelabber)
• Gerbil Version:
• Traefik Version:
• Newt Version:
• Client Version:

To Reproduce

Add multiple country is not entries in access rules

Expected Behavior

You should be okay connecting from an IP from any of the countries entered. But reality is that only the first country will be used.

[dubeyharshit0605]

Hi @MohamedElashri , thanks for reporting this. I’d like to investigate it if it’s available for an external contribution.
I’ll reproduce the behavior with multiple country is not entries, trace how those values are serialized and evaluated, and add a regression test before implementing the fix.
Before changing the logic, could a maintainer clarify the intended combination semantics for multiple negative-country conditions? I want to ensure the fix matches the expected access-control behavior rather than assuming whether the conditions should use AND or OR.
If that direction looks right, I’d be happy to implement it and open a PR.

[AstralDestiny]

Feel free to open a draft or and explain what you are going to do first to reduce the possibility of it possibly being rejected if I recall. @dubeyharshit0605