i’ve noticed that firewall groups (address and network) are created as ipset with a maxelem of 65536.
For our border router which also acts as border firewall we have a list of about 85000 IPv4 addresses and 3500 IPv4 Subnets which need to be filtered.
We created a new empty firewall address group and tried to add the about 80000 IPs by the set firewall group address-group ipv4-blocklist-hosts address command.
This seems to be not the best idea and is terrible slowly --> Not our choice.
Another idea was to use this empty address group and add the IP addresses directly to the created IPset. Thus the IPset is created by vyos with a maxelem of 65536 this also is no option.
We could simply bypass this maxelem by creating several firewall groups which, i guess is not the best option and will get a mess in automating the updates.
I’ve read from other people having the same “issue” trying to bypass the default value.
A new and simple to implement option, where we can specify the maxelem count with a default value of the current 65536 would overcome this “issue”:
set firewall group address-group ipv4-blocklist-hosts maxelem [0-1000000]
set firewall group network-group ipv4-blocklist-network maxelem [0-1000000]
set firewall group ipv6-address-group ipv6-blocklist-hosts maxelem [0-1000000]
set firewall group ipv6-address-group ipv6-blocklist-networks maxelem [0-1000000]
If this isn’t any option for the developers, any idea to overcome this limitation is very appreciated.