RetroFed Forum
Your home away from modern life.
wireguard disallow a lot of geo subnets
Post Reply
AuthorMessage
erin (she/it, kitty meowww meoww) piefed.blahaj.zone erinmeow@piefed.blahaj.zone
Joined: 2026-03-12
Quote

i have a ton of all russian subnets which i doesnt want route through vpn due vpn monitoring on rzzian faschist services, and services which blocking all non-rzzian ips

also since i wanna use wireguard(amneziawg obsurfication fork, since plain wg is blocked) on a openwrt system soooo maybe there are way to route all traffic thru wg interface but subnet list thru plain interface

aaaaaaaaa i dont have much openwrt stuff knowledge,

5   Original
okwhateverdude lemmy.world okwhateverdude@lemmy.world
Joined: 2023-08-01
#2 · Quote Reply

This is doable, just tedious by hand. Your favorite clanker can walk you through the steps to find a geoip datasource (eg. bootleg maxmind, ASN lists, etc), and either directly write the routes, or a script that will generate it from that source.

5
stratself lemdro.id stratself@lemdro.id
Joined: 2025-08-21
#3 · Quote Reply

You're probably interested in creating a firewall on openwrt that blocks all traffic from/to certain IPs

3
erin (she/it, kitty meowww meoww) piefed.blahaj.zone erinmeow@piefed.blahaj.zone
Joined: 2026-03-12
#4 · Quote Reply

You're probably interested in creating a firewall on openwrt that blocks all traffic from/to certain IPs

as i understand i can do by one subnet separatly but the problem that there are 1000+ subnets, maybe i dont know some feature to load an ipset file also uguguhguhg isnt parsing 1000+ subnets are load on cpu?

2
erin (she/it, kitty meowww meoww) piefed.blahaj.zone erinmeow@piefed.blahaj.zone
Joined: 2026-03-12
#5 · Quote Reply

This is doable, just tedious by hand. Your favorite clanker can walk you through the steps to find a geoip datasource (eg. bootleg maxmind, ASN lists, etc), and either directly write the routes, or a script that will generate it from that source.

https://github.com/C24Be/AS_Network_List, this repo give me idea make a script which generating a routes

3
SteveTech aussie.zone SteveTech@aussie.zone
Joined: 2025-09-30
#6 · Quote Reply

as i understand i can do by one subnet separatly but the problem that there are 1000+ subnets, maybe i dont know some feature to load an ipset file also uguguhguhg isnt parsing 1000+ subnets are load on cpu?

I'm not sure how a firewall would help, you'd definately want to do this from the routing table.

isnt parsing 1000+ subnets are load on cpu?

IPv4 addresses are basically just 32bit numbers, any somewhat modern CPU can check through 1000 routes in nanoseconds.

Also 1000+ seems a bit excessive, you should be able to aggregate some of those subnets into a few bigger ones. There are calculators online for this, or you can script it.

3
Post Reply
Back to top