Cloudron makes it easy to run web apps like WordPress, Nextcloud, GitLab on your server. Find out more or install now.


Skip to content
  • Categories
  • Recent
  • Tags
  • Popular
  • Bookmarks
  • Search
Skins
  • Light
  • Cerulean
  • Cosmo
  • Flatly
  • Journal
  • Litera
  • Lumen
  • Lux
  • Materia
  • Minty
  • Morph
  • Pulse
  • Sandstone
  • Simplex
  • Sketchy
  • Spacelab
  • United
  • Yeti
  • Zephyr
  • Dark
  • Cyborg
  • Darkly
  • Quartz
  • Slate
  • Solar
  • Superhero
  • Vapor

  • Default (No Skin)
  • No Skin
Collapse
Brand Logo

Cloudron Forum

Apps | Demo | Docs | Install
  1. Cloudron Forum
  2. Feature Requests
  3. Geo Filtering for nftables Brings Simplicity & Flexibility to Geolocation Matching

Geo Filtering for nftables Brings Simplicity & Flexibility to Geolocation Matching

Scheduled Pinned Locked Moved Feature Requests
1 Posts 1 Posters 430 Views 1 Watching
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • robiR Offline
    robiR Offline
    robi
    wrote on last edited by robi
    #1

    This looks like a good upgrade, simplifying the blocklist use case.

    https://github.com/wirefalls/geo-nft

    Geolocation for nftables is a Bash script to create nftables sets of country specific IP address ranges for use with firewall rulesets. The project provides a simple and flexible way to implement geolocation filtering with nftables.

    • A script written for the widely used Bash shell.
    • Easy to set up, configure and customize with source code that's heavily commented.
    • Uses the free geolocation database from db-ip.com (no EULA to accept).
    • Automatically generates country-specific nftables address range sets.
    • The script has a small memory footprint to run well on systems with limited RAM. A flexible configuration allows loading only minimum sets required if memory is tight.
    • User settings are stored in a standard configuration file rather than using command line arguments.
    • Packets can be geolocation filtered with a single nftables rule rather than two rules to mark and match packets like nftables map based solutions.
    • The script allows access to all of the valid country code address ranges in the database.
    • Automatically determines your installed version of nftables and recommends the correct "include" statements for your ruleset. The script also creates "include-all" files to allow you to include all geolocation sets with a single reference on older versions of nftables that don't support include wildcards.
    • The User Guide explains how to define all element definitions for geolocation sets in one file, eliminating the chance of having out-of-sync definitions in multiple files when flushing and refilling sets with new data.
    • Simplified directory structure to shorten "include" path names.
      The script creates ~500 IPv4 and IPv6 set files from the geolocation database in about 10 seconds on a low power quad-core 2200ge server with SSD storage.
    • Tested on Ubuntu Server, Fedora Server, and Raspberry Pi OS.

    Conscious tech

    1 Reply Last reply
    0
    Reply
    • Reply as topic
    Log in to reply
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes


    • Login

    • Don't have an account? Register

    • Login or register to search.
    • First post
      Last post
    0
    • Categories
    • Recent
    • Tags
    • Popular
    • Bookmarks
    • Search