ipfw divert filter for IPv4 geo-blocking

[Julian Elischer]

trimming....

On 27/07/2016 11:51 PM, Ian Smith wrote:
> On Wed, 27 Jul 2016 10:03:01 +0800, Julian Elischer wrote:
>
[...]

>
>   > country without changing everything else.
>   > (the downside is that dynamic skipto's are not very efficient as they do a
>   > linear search of the rules, where static skiptos cache the location of the
>   > rule to skip to. it's not a terrible cost but it needs to be  kept in mind.
>   > (but faster than a divert socket)
>
> I forget .. is that linear search from the beginning, or from the
> position of the rule querying the table?  Just thnking about grouping
> skipto target rules to minimise traversal.  These targets in turn could
> use static skiptos that will be cached.
it starts searching forwards from the current location, to stop loops.
(though it turns out you CAN make loops using some arcane sequences 
that I will not make public).

However divert reinjection searches from the start to get to the place 
you want to restart processing.
(but it's a very small loop) so put the diverts near the front if you can.

>
>   > your application becomes an application for configuring the firewall.
>   > (which you do by feeding commands down a pipe to ipfw, which is started as
>   > 'ipfw -q /dev/stdin')
>
> I went looking though ports for ipfw-classifyd, which attracted my
> interest in 2008, but seems never to have made it to ports.  Written by
> Mike Makonnen <mtm at FreeBSD.Org> (cc'd), it uses divert sockets with the
> linux- based 'l7' filters for detecting traffic from a wide array of UDP
> and TCP protocols, with the primary intent then of detecting various P2P
> traffic and shunting it through dummynet pipes for bandwidth limiting.
I vaguely remember it.
>
> Interesting discussion, and thanks for info on geoip tables etc.
>
> cheers, Ian
>