Anubis challanges *every* request, even after testing with Cookie set, coming from specific countries

[Midar]

Describe the bug

I'm on Anubis 1.25.0.

My users complained that every single request gets challenged, even when they passed the challenge. This breaks the site entirely, as instead of the .css being served, another challenge is served.

This only happens for users from specific countries. So far this has been confirmed for China and Colombia. These users have no problems anymore if they leave everything about their setup as it is, but use a VPN to a different country.

It seems Anubis' default policies consider some IP ranges more suspicious and in that case, it doesn't even matter anymore if the challenge was passed.

Steps to reproduce

1. Use the standard policies
2. Get an IP from one of the affected countries
3. See how the site is unusable because even the .css gets challanged, breaking everything

Expected behavior

Anubis should let the combination of {IP, Cookie} pass after the challenge has been passed.

Your operating system and its version.

Any

Your browser and its version.

Any

Additional context

No response

[Xe]

Are they using CGNAT? You may need to adjust the cookie restriction header to their user-agent string instead of their remote IP address.

[Midar]

I can confirm for the connections coming from Colombia that they are behind a CGNAT. For the connections coming from China I don't know.

Would it make sense to only use the first 16 bit of the IPv4?