Feedback and questions

[matteganau]

Thanks for creating CIDRe. I thought I'd pass on feedback and ask a couple questions if that's OK.

Running Ubuntu 22.04 with Python 3.10.12.

$ cidre pull --merge
Traceback (most recent call last): 
  File "/home/matt/.local/bin/cidre", line 5, in <module>
    from cidre.cli import main
  File "/home/matt/.local/lib/python3.10/site-packages/cidre/cli.py", line 142
    f"💡 Pulling ranges from RIRs to compile CIDRs with {"enabled" if args.merge else "disabled"} merging...",
                                                            ^^^^^^^  
SyntaxError: f-string: expecting '}'

Installing Python 3.13.2, associated venv package and installing CIDRe in a venv resolved the above.

To restore firewall rules on boot, do you recommend an alternative to using rc.local for anyone who finds themselves using systemd? I've gone with crontab's @reboot (untested for now, I'll let you know if it doesn't work).

Do I need to fetch the latest IP allocations and if so how often do you recommend doing so?

How do you verify it's working, what logs do you monitor and what do you look for?

Thanks again.

[matteganau]

Do I need to fetch the latest IP allocations and if so how often do you recommend doing so?

Sorry. Another question. If I run cidre pull --merge do I need to run cidre deny ... again to add new IPs to existing sets/rules or is that taken care of by merge?

[alex-vulnebify]

Hey-hey @matteganau 👋

Thank you for the feedback! It's valuable for me, for cidre and the tooling that I'm going to ship next 🚢

To restore firewall rules on boot, do you recommend an alternative to using rc.local for anyone who finds themselves using systemd? I've gone with crontab's @reboot (untested for now, I'll let you know if it doesn't work).

I'll take a look this week to find out the best approach as well as the fix of usage cidre with Python 3.10.12.

Do I need to fetch the latest IP allocations and if so how often do you recommend doing so?

TLDR: weekly will be fine

Long answer based on the data:
I don't have historical data yet BUT the repository that inspired me has!

In average CIDRs in RIRs change 3 times per day (with hourly checking). Of course, there could be changes for many countries. So, the frequency depends on the country. Here is the way how to check that to fulfill your use case:

git clone https://github.com/herrbischoff/country-ip-blocks/
cd country-ip-blocks
git log --since="1 year ago" --pretty=oneline | wc -l
# 1095
git log --since="1 year ago" --oneline -- ipv4/ru.cidr | wc -l
# 129

Sorry. Another question. If I run cidre pull --merge do I need to run cidre deny ... again to add new IPs to existing sets/rules or is that taken care of by merge?

Thanks for asking! Yeah, I decoupled the requests to RIRs (pull) and operations with firewall (deny|allow|reject). So, to achieve updates of the rules you should cidre pull --merge && cidre deny ....

The --merge means that we merge neighbors CIDRs (if any)

[alex-vulnebify]

How do you verify it's working, what logs do you monitor and what do you look for?

It depends what you expose to the Internet. For example, if there is nginx you can double-check the logs, randomly pick IP addresses and check the location. If you host the website there is the services that might help you to check that.

Personally, I have a lot of proxies of different countries and just make proxied curl:
curl -x http://proxy_host:port https://example.com

Now, I'm thinking to ship 🚢 another small tool that will be checking the resource from multiple countries.