Now that I've got nft set up to do rate limiting to ensure my pod is available to the broader public and also have a bit more insight into who my visitors are one thing stood out. Apparently my miscreants are mostly ips which when doing a reverse dns lookup resolve to something under googleusercontent.com.
A quick google of this domain name turns up many complaints about peoples services being relentlessly hammered by this source of traffic. The googleusercontent.com domain is part of googles compute offerings (GCP). I then quietly wondered to myself if it overly likely that I am to receive legitimate (read human) traffic from GCP. I couldn't really think of any and luckily GCP document its CIDR ranges at:
https://www.gstatic.com/ipranges/cloud.json
So armed with this knowledge and with a taste for vengeance I set off to block all of GCP. The first thing was to add a blocklist to my nftables.conf:
set blocklist {
type ipv4_addr
flags interval
}
Next a rule in my input chain to act on it and keep tabs on how many connections were blocked:
ip saddr @blocklist counter drop
Lastly I summoned my old friends curl and jq to help populate the blocklist itself and made it into a bash script to refresh the blocklist at will for when it updates.
#!/bin/bash
set -euo pipefail
cidrs=$(curl -s https://www.gstatic.com/ipranges/cloud.json \
| jq -r '.prefixes[].ipv4Prefix // empty')
if [ -z "$cidrs" ]; then
echo "Failed to fetch GCP ranges" >&2
exit 1
fi
nft flush set inet filter blocklist
elements=$(echo "$cidrs" | paste -sd, -)
nft add element inet filter blocklist "{ $elements }"
count=$(echo "$cidrs" | wc -l)
echo "Blocked $count GCP CIDR ranges"
One of the many joys of serving a personal gemini pod / website is not having to give a shit about being overzealous in the approach to Internet hooligans. So what if I block 919 CIDR ranges its not likely to result in any financial loss on my part!