The even fatter cat

Fresh off blocking GCP with my evil laughter still echoing throughout the lair it struck me that while GCP had been the most obvious nemesis of my pod there was still a rather large elephant still lingering in the room. All while banning GCP I had left AWS off the hook. That seemed entirely unfair to AWS and I set off to block them in the same manner.

Luckily they too are kind enough to publish their IP ranges:

https://ip-ranges.amazonaws.com/ip-ranges.json

The share size of this list and the fact that there was overlap in its listed IPs made for change to the blocklist definition:

set blocklist {
  type ipv4_addr
  flags interval
  auto-merge
}

The auto-merge is helpful to handle the overlap. The rest is pretty much the same approach except batching the adding of CIDRs to the blocklist with xargs.

#!/bin/bash
set -euo pipefail

cidrs=$(curl -s https://ip-ranges.amazonaws.com/ip-ranges.json \
  | jq -r '.prefixes[].ip_prefix // empty')

if [ -z "$cidrs" ]; then
  echo "Failed to fetch AWS ranges" >&2
  exit 1
fi

echo "$cidrs" | xargs -n 500 bash -c \
  'nft add element inet filter blocklist "{ $(printf "%s\n" "$@" | paste -sd, -) }"' _

count=$(echo "$cidrs" | wc -l)
echo "Blocked $count AWS CIDR ranges"

If there is one good thing about these too big to fail compute monopolies it's that they are rather easy to shut down en mass.

Reply by email

Back

Home