Cloudron makes it easy to run web apps like WordPress, Nextcloud, GitLab on your server. Find out more or install now.


    Cloudron Forum

    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular

    Geo Filtering for nftables Brings Simplicity & Flexibility to Geolocation Matching

    Feature Requests
    1
    1
    136
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • robi
      robi last edited by robi

      This looks like a good upgrade, simplifying the blocklist use case.

      https://github.com/wirefalls/geo-nft

      Geolocation for nftables is a Bash script to create nftables sets of country specific IP address ranges for use with firewall rulesets. The project provides a simple and flexible way to implement geolocation filtering with nftables.

      • A script written for the widely used Bash shell.
      • Easy to set up, configure and customize with source code that's heavily commented.
      • Uses the free geolocation database from db-ip.com (no EULA to accept).
      • Automatically generates country-specific nftables address range sets.
      • The script has a small memory footprint to run well on systems with limited RAM. A flexible configuration allows loading only minimum sets required if memory is tight.
      • User settings are stored in a standard configuration file rather than using command line arguments.
      • Packets can be geolocation filtered with a single nftables rule rather than two rules to mark and match packets like nftables map based solutions.
      • The script allows access to all of the valid country code address ranges in the database.
      • Automatically determines your installed version of nftables and recommends the correct "include" statements for your ruleset. The script also creates "include-all" files to allow you to include all geolocation sets with a single reference on older versions of nftables that don't support include wildcards.
      • The User Guide explains how to define all element definitions for geolocation sets in one file, eliminating the chance of having out-of-sync definitions in multiple files when flushing and refilling sets with new data.
      • Simplified directory structure to shorten "include" path names.
        The script creates ~500 IPv4 and IPv6 set files from the geolocation database in about 10 seconds on a low power quad-core 2200ge server with SSD storage.
      • Tested on Ubuntu Server, Fedora Server, and Raspberry Pi OS.

      Life of Advanced Technology

      1 Reply Last reply Reply Quote 0
      • First post
        Last post
      Powered by NodeBB