PVE Firewall - GEOIP &/or ASN

[KatyComputer]

Has anyone found a clever way to integrate GEOIP &/or ASN rules into PVE's firewall?

We have implemented 2FA on all systems, we restrict access to sensitive systems based on IP address, next, I want to restrict all remaining systems to networks within our metropolitan region.

 

[Alwin]

Has anyone found a clever way to integrate GEOIP &/or ASN rules into PVE's firewall?

You could define IPSETs and update them through the API. But those rules might get big and slow down the sync to the other nodes (or even fail if the DB doesn't fit into memory anymore).
https://pve.proxmox.com/pve-docs/api-viewer/index.html

Another (maybe better) approach would be the let some IDS/IPS handle this kind of dynamic filtering.
https://pve.proxmox.com/pve-docs/chapter-pve-firewall.html#_tips_and_tricks