Group geoip countries

Hello,

A nice feature on VyOS 1.4 would be to be able to create country code groups via geoip. For example :

set firewall group geoip-group GEOIP_BL country 'ru'
set firewall group geoip-group GEOIP_BL country 'jp'
set firewall group geoip-group GEOIP_BL country 'cn'
set firewall group geoip-group GEOIP_BL continent 'asia'
# Blacklist GeoIP
set firewall name WAN-LAN rule 1 source group geoip-group 'GEOIP_BL'
set firewall name WAN-LAN rule 1 action 'drop'
set firewall name WAN-LAN rule 1 log 'enable'
set firewall name WAN-LAN rule 1 description 'Drop GEOIP_BL'

This would make it possible to have just one rule instead of numerous rules like this one:

set firewall name WAN-LAN rule 1 source geoip country-code 'cn'
set firewall name WAN-LAN rule 1 action 'drop'
set firewall name WAN-LAN rule 1 log 'enable'
set firewall name WAN-LAN rule 1 description 'Drop China from WAN'

Sorry for my English.

Hi @nyxtorm!

Thank you for your feature suggestion regarding creating country code groups via GeoIP in VyOS 1.4. Your English is perfectly fine, so no need to apologize! If you have any more suggestions or feedback, please don’t hesitate to share them. We value your input.

Thank you again for your contribution!

Best regards,
Joe

1 Like

As far as I know, We cant implement the GeoIP with ipset command on vyos 1.2/1.3. But on vyos 1.4, the iptables was switched to nftables. The ipset command has gone.

# set a firewall group
set firewall group network-group goeip_us

# Shell script to loop add the network ranges with ipset
for networks in `cat /config/usipranges.txt`; do sudo ipset add  geoip_us $networks;done

the ipset to load the ip networks very fast.
The question is how to loop add network groups with ipset like command on vyos 1.4?

We use geoip with nftables sets
But without group in 1.4

Maybe moving geoip to groups is better options or re-usage, because current implementation creates a set for every rule which uses geoip.
So, if we create n rules using the same geoip group, it will generate n sets, which will have different names but all have the same IPs.

how to load the network group to match vyos and nftable? Then we can set pbr routing with it.

if i want to add some network ranges and ips in the country group. Is that possible to customize the group by myself?

So far this is not possible with vyos commands. But using nft commands directly, this can be done!

any document i can follow? I need this feature when the vyos1.4 release.

 set firewall name <name> rule <1-999999> source geoip country-code <country> 
1 Like

HI @Viacheslav
I want to define a network group such as US_COUNTRY with all IPs in it. If the country defines as firewall rule, I can define a network group with PBR, Any plan to implement or can I do it with the NFT command to implement it by myself?

Currently geo-ip is not available in PBR.
You can create a feature request in https://vyos.dev/

Hi @n.fort,

For my part, I created my account on https://vyos.dev/ more than a week ago to report a few things. Is it normal that it is still in “Wait for Approval” status? It’s Nyxtorm username as well.

Approved! Please check once again!

@n.fort, Just perfect, thank you ! :+1:

THX, I created a ticket ⚓ T5278 custome firewall network-group and update CIDR from a file

1 Like