search

rpthms / nft-geo-filter

Allow/deny traffic in nftables using country specific IP blocks
MIT License
98 stars 24 forks source link

Make possible to use cybercrime blocklists #26

Closed andrey-utkin closed 2 years ago

andrey-utkin commented 2 years ago

This is obviously out of scope for nft-geo-filter project, but the interface and the codebase are so good it makes so much sense. Alternatives are hard to find. FireHOL uses iptables and their datasets don't have IPv6 entries. firewalld introduces its own file formats which is extra complexity. https://github.com/akurov/nftables-firehol has no IPv6. https://github.com/kubax/blocklist-with-nftables has good scope but has limiting factors of social kind: not actively maintained, not well-known, Perl popularity is in decline.

Examples of use:

nft-geo-filter --table-family netdev --interface eth0 --provider blocklist.de all nft-geo-filter --table-family netdev --interface eth0 --provider iplists.firehol.org --no-ipv6 firehol_level1 (otherwise it fails to insert an empty IPv6 list)

andrey-utkin commented 2 years ago

Hi @rpthms , I'd like to thank you for publishing and maintaining your fine program. Don't worry if you want to decline this patch. It's not going to be a problem for me, as I can keep using my patch on my own, or settle with something more suitable. I do this patch submission to share my finding that your tool accomodates very well this extra usecase. Probably it'd be wrong to call this usecase "unanticipated" - I guess you could think of it or even be asked to add it beforee.

rpthms commented 2 years ago

Hey @andrey-utkin, thanks for the PR.

You're right that adding these extra IP blocklist providers might be a bit out of scope for this script, since there's no country specific lists being provided by them. I want this script to remain focused on filtering countries, so unfortunately I don't think I can merge this patch.

Sorry about this. I'm glad that the script is working out for you.