Recommendations for sensible ruleset?

[jon]

@dal8moc

I was looking into building groups for ASNs

See:

Need help with network issue - Maybe squid related?

Thanks! Yes, I plan to document! And I’ll document the ipset / ASN version. I used location → ipset → iptables match-set The location package makes this VERY easy! ASN=16509 location list-networks-by-as --format=ipset --family=ipv4 ${ASN} > "/etc/ipset/AS${ASN}.ipset" ipset restore < "/etc/ipset/AS${ASN}.ipset" . and the above feeds this… iptables -t nat -N BYPASS iptables -t nat -A CUSTOMPREROUTING -s 192.168.60.218/32 -p tcp -m tcp --dport 80 -j BYPASS iptables -t nat -A BYPASS -m set …

output looks like this:

[root@ipfireAPU ~] # ASN=1
[root@ipfireAPU ~] # location list-networks-by-as --format=ipset --family=ipv4 ${ASN} > "/etc/ipset/AS${ASN}.ipset"
[root@ipfireAPU ~] # cat /etc/ipset/AS${ASN}.ipset
create AS1v? hash:net family inet hashsize       64 maxelem 1048576 -exist
flush AS1v?
add AS1v? 45.176.150.0/23
add AS1v? 91.225.188.0/22
add AS1v? 140.106.216.0/24
add AS1v? 140.106.223.0/24
add AS1v? 155.133.112.0/21
add AS1v? 205.207.214.0/24
add AS1v? 212.94.84.0/22
[root@ipfireAPU ~] #