From owner-freebsd-ipfw@freebsd.org  Tue Jul 26 19:05:46 2016
Return-Path: <owner-freebsd-ipfw@freebsd.org>
Delivered-To: freebsd-ipfw@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id 8C3A6BA5105
 for <freebsd-ipfw@mailman.ysv.freebsd.org>;
 Tue, 26 Jul 2016 19:05:46 +0000 (UTC)
 (envelope-from julian@freebsd.org)
Received: from vps1.elischer.org (vps1.elischer.org [204.109.63.16])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client CN "vps1.elischer.org",
 Issuer "CA Cert Signing Authority" (not verified))
 by mx1.freebsd.org (Postfix) with ESMTPS id 699781805
 for <freebsd-ipfw@freebsd.org>; Tue, 26 Jul 2016 19:05:46 +0000 (UTC)
 (envelope-from julian@freebsd.org)
Received: from Julian-MBP3.local
 (ppp121-45-233-115.lns20.per1.internode.on.net [121.45.233.115])
 (authenticated bits=0)
 by vps1.elischer.org (8.15.2/8.15.2) with ESMTPSA id u6QJ5eJU068078
 (version=TLSv1.2 cipher=DHE-RSA-AES128-SHA bits=128 verify=NO);
 Tue, 26 Jul 2016 12:05:43 -0700 (PDT)
 (envelope-from julian@freebsd.org)
Subject: Re: ipfw divert filter for IPv4 geo-blocking
To: Michael Sierchio <kudzu@tenebras.com>,
 "freebsd-ipfw@freebsd.org" <freebsd-ipfw@freebsd.org>
References: <61DFB3E2-6E34-4EEA-8AC6-70094CEACA72@cyclaero.com>
 <9d0a3ad8-a66a-c527-3906-3290b8d58476@rlwinm.de>
 <ffaad855-2a2e-6034-e9fe-5b685276a2b9@freebsd.org>
 <CAHu1Y72JZzXTp_YGsFe31j79vi0TNBQCm+oPze=3QB6zf8G08g@mail.gmail.com>
From: Julian Elischer <julian@freebsd.org>
Message-ID: <59d70c14-1524-8279-7b91-1620e2f688a7@freebsd.org>
Date: Wed, 27 Jul 2016 03:05:35 +0800
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0)
 Gecko/20100101 Thunderbird/45.2.0
MIME-Version: 1.0
In-Reply-To: <CAHu1Y72JZzXTp_YGsFe31j79vi0TNBQCm+oPze=3QB6zf8G08g@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
X-BeenThere: freebsd-ipfw@freebsd.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: IPFW Technical Discussions <freebsd-ipfw.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-ipfw>,
 <mailto:freebsd-ipfw-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-ipfw/>
List-Post: <mailto:freebsd-ipfw@freebsd.org>
List-Help: <mailto:freebsd-ipfw-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-ipfw>,
 <mailto:freebsd-ipfw-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 26 Jul 2016 19:05:46 -0000

On 27/07/2016 1:40 AM, Michael Sierchio wrote:
> On Tue, Jul 26, 2016 at 9:26 AM, Julian Elischer <julian@freebsd.org> wrote:
>
>      table 1 { DE, NL } -> 10000,
>>>                  { US, UK } -> 10100
>>>      table 2 { CN, KO, TR } -> 20000
>>>
>> why multiple tables?
>> if you load the table at once you can assign a country code as the
>> tablearg for every run of addresses. all in one table.
>
> I mentioned that in my earlier response - but if the point is to block
> entire countries (or any collection of CIDR blocks, for that matter), it's
> sufficient to have a whitelist table and a blacklist table. The table arg
> could also be a skipto rule number, right? And you can do policy-based
> routing, with the table arg as a FIB number.
>
> Passing the packet to userland via divert sockets was a brilliant idea in
> 2003. natd was pretty much the first NAT mechanism to properly handle ICMP
> error responses, too.
2003?  nahh we wrote it and divert in 96 :-)

>