Migration from 0.7.X to 0.8.X

[vdias]

I am currently evaluating the upgrade from geoip-shell 0.7.X to 0.8.X and would like to confirm the correct procedure for my specific configuration.

Current Setup:

• Whitelist: Spain (ES) and Portugal (PT) using MaxMind.
• Custom Blocklist: A personal script that retrieve three trusted Threat Intelligence Feeds (HaGeZi TIF, Emerging Threats, and IPsum Level 4), extract all listed IP addresses, and generate a consolidated blocklist limited to IPs located in Spain (ES) and Portugal (PT) based on MaxMind GeoLite2 geolocation data.
• Firewall Backend: nftables.

With the introduction of IPinfo in version 0.8.0, I am analyzing whether a switch is beneficial for my use case. Given that my whitelist is restricted to only two countries (ES and PT), is there a significant advantage to using IPinfo? I am concerned about the memory footprint in nftables since IPinfo lists tend to be larger, and MaxMind has been stable for this specific geographical scope.

In version 0.7.X, I used the configure -B flag to handle my personal blocklists. Based on the 0.8.X documentation, it appears this has been deprecated in favor of the import action. Could you confirm if the following transition is the recommended approach for importing external malware IP lists? IS there any alias or i really need to change execution?
Previous: geoip-shell configure -B /path/to/malware_list.txt
New: geoip-shell import -B /path/to/malware_list.txt

Are there any additional internal configuration flags in the new version that I should adjust to ensure my custom blocklist takes precedence over the country whitelists? I would appreciate any insights or breaking changes I should be aware of before finalizing the migration.

[friendly-bits]

is there a significant advantage to using IPinfo?

Support for IPinfo was added at the request of IPinfo representative (no affiliation - just satisfying a legitimate feature request). I do not have any information on how IPinfo compares to other sources in regards to blocking effectiveness or accuracy. Perhaps you could ask about this on IPinfo customers forum.

I am concerned about the memory footprint in nftables since IPinfo lists tend to be larger

AFAIK, ES and PT lists are not particularly large, so (provided you have a couple hundreds of megabytes free memory), I don't think that you will run into issues.

Could you confirm if the following transition is the recommended approach for importing external malware IP lists?

Previous: geoip-shell configure -B /path/to/malware_list.txt
New: geoip-shell import -B /path/to/malware_list.txt

Yes, this is correct.

IS there any alias or i really need to change execution?

geoip-shell does not implement an alias. You could perhaps set up a custom shell alias on the given system, but IMO changing the command in your custom script is a better approach.

Are there any additional internal configuration flags in the new version that I should adjust to ensure my custom blocklist takes precedence over the country whitelists?

No, there have been no significant changes to the firewall rules structure and order created by geoip-shell.

I would appreciate any insights or breaking changes I should be aware of before finalizing the migration.

I am not aware of any breaking changes with the latest geoip-shell version (v0.8.3) vs v0.7.8.1.

Depending on which system you are running geoip-shell on, after the upgrade you may want to consider changing the config option keep_fetched_db (renamed from keep_mm_db) to true. This does not affect normal operation of geoip-shell, however in cases where you need to change the IP lists or use the check_ip_in_source script or perform other actions which require re-fetching the database from MaxMind/IPinfo, this will allow geoip-shell to reuse the previously fetched database, which saves time and prevents running into download limits imposed by the data provider. This option is now set to true by default, except on OpenWrt.