-
Notifications
You must be signed in to change notification settings - Fork 17
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Separate dictionary creation #1
Comments
Hi sunshine, I think this is a good enhacement idea. I just need to take some time organizing the project before, like adding some contribution guide and dealing with formatting issues (using |
Hi JMGuisadoG In fact, even if this script after modified can be run successfully, it will also trigger oom when nft -f output file. This is an nft memory issue. The only way is add more memory or modify the script to fetch smaller list(In my case, I only need one country IP list). If choose add more memory, this issue will not happen. So I think this issue is not strongly needed. It is kind if warning people use geoip nftables function required more than 300M free memory space. |
It's indeed interesting and a good opportunity to take into account use cases I did not foresee.
Output by continent should also be implemented and should alleviate memory usage when using As you can see
Maybe I should add this to the caveats section. Thanks for your feedback! |
Another possibility, if I may suggest one, would be to limit the map to a limited set of countries (specified on the command line) instead than by continents. |
This is a good idea, all this may fall into enhancements to the script functionality, adding parameters and modularizing the execution, so probably I'd open separate issues or create a GitHub project to track this properly. |
For the record, new changes have reduced memory usage of the script execution by 150MB more or less.
Yields As of now, there exists other tools¹ that focus on generation of geoip sets for nftables. So, I think it reasonable to point to those tools if a set is preferred over a map. I'd have no problem adding a country filter as arguments but I don't know how preferable is a few countries map over an address set for each country. I most probably will add optional flags to only write ipv4 or ipv6, writing both if none of the flags are present. |
It's a fair point, I agree. |
Yes! Because I guess most people want to use this on a basis of "I want to block traffic from everywhere except for country A and B". Separate files like |
This PR has been merged into the script: #7 Now there is the possibility to generate nft maps containing only a set of specified countries using the |
Machine: GCP f1-micro
The text was updated successfully, but these errors were encountered: