Summary

Add list of networks to firewall/group/network-group for PBR from file.

Use case

In China, Google/Facebook/X are blocked, that's why I tried to add clash support on VyOS.

I planned to import a list of China IANA networks, in PBR I can add a rule, if destination matches, traffic would not go thru VPN (clash or others).

With PBR, I can also add source matching rules to let all traffic from some clients forwarded to VPN.

On UBNT, I wrote a script to perform ipset -! add. I planned to do similar but nftables doesn't have similar simple command.

My new plan is:

1. add cfg node like set firewall group network-group CHINA_IP source-file path-to-list-file, nat.py reads list and add to network list, source-file and network can be mutually exclusive.
2. add op command like update firewall-group CHINA_IP to reload from list-file

Users write their own scripts to maintain the list-file.
The list-file uses simple format, one network each line.

Additional information

There is geoip in firewall/ipvX but not in firewall/group.

Several github project for such lists.

https://github.com/17mon/china_ip_list
https://github.com/ruijzhan/chnroute

PR: https://github.com/vyos/vyos-1x/pull/4341