GeoIP-based nftables firewall filter for Linux. Automatically downloads IP geolocation data and generates nftables rulesets to allow or deny traffic by country.

The tooling is a two-stage pipeline:

1. geomap.py fetches IP geolocation data from public sources and writes per-country CIDR prefix lists to disk.
2. geofw.py reads those prefix lists and renders a complete nftables ruleset via a Jinja2 template.

geomap.py          geofw.py             nftables
┌──────────┐       ┌──────────┐         ┌──────────┐
│ RIR/CSV/ │──────>│ CC.ipv4  │────────>│ nft -f   │
│ MMDB     │       │ CC.ipv6  │  .nft   │ geoblock │
└──────────┘       └──────────┘         └──────────┘
  download        /var/lib/geomap        load rules

• Python 3.10+
• Jinja2 (pip install jinja2) — only needed for geofw.py
• geomap.py has no external dependencies (stdlib only)
• nftables (for loading the generated ruleset)

geomap.py downloads geolocation data and writes per-country files (DE.ipv4, DE.ipv6, etc.) to an output directory.

# From RIR delegation files (recommended)
geomap.py rir -o /var/lib/geomap

# From DB-IP CSV (auto-downloads latest)
geomap.py csv -o /var/lib/geomap

# From a local DB-IP CSV file
geomap.py csv -o /var/lib/geomap -i /tmp/dbip-country-lite.csv.gz

# From a local or remote MMDB file
geomap.py mmdb -o /var/lib/geomap -i /tmp/dbip-country.mmdb.gz

Each country produces two files in the output directory:

/var/lib/geomap/DE.ipv4    # one IPv4 CIDR prefix per line
/var/lib/geomap/DE.ipv6    # one IPv6 CIDR prefix per line

Overlapping prefixes are automatically collapsed via ipaddress.collapse_addresses().

geofw.py reads the prefix lists and produces a self-contained nftables ruleset for the inet family.

• accept (allow-list) — Permits traffic from listed countries, drops everything else. Automatically exempts loopback, wireguard (wg0), RFC 1918 private ranges, and IPv6 link-local. Established/related connections are also allowed.
• drop (deny-list) — Drops traffic only from the listed countries; all other traffic passes through.

# Preview an allow-list ruleset (dry run, prints to stdout)
geofw.py -c DE,AT,CH -a accept --log --dry-run

# Generate a deny-list ruleset and write to file
geofw.py -c RU,CN -a drop --log -o /etc/nftables.d/geoblock.nft

# Load the ruleset into nftables
nft -f /etc/nftables.d/geoblock.nft

geofw.py computes a SHA256 fingerprint over all inputs (prefix files, config flags, and template content) and embeds it in the output file header. On subsequent runs, if the fingerprint matches the existing output file, generation is skipped. Use --force to override this behavior.

The repository includes systemd units for automatic weekly updates.

Runs geomap.py rir weekly to refresh the prefix lists. The service runs as a dedicated geomap user with systemd hardening (ProtectSystem=strict, ProtectHome=true, NoNewPrivileges=true).

# Install the timer and service
cp systemd/system/geomap.service /etc/systemd/system/
cp systemd/system/geomap.timer /etc/systemd/system/

# Enable and start the timer
systemctl daemon-reload
systemctl enable --now geomap.timer

Runs geofw.py after geomap.service to regenerate the nftables ruleset and load it via nft -f. Edit the ExecStart line in the service file to match your desired countries and action before installing.

cp systemd/system/geofw.service /etc/systemd/system/
# Edit /etc/systemd/system/geofw.service to set your countries and action
systemctl daemon-reload

# 1. Create the geomap user and data directory
useradd -r -s /usr/sbin/nologin geomap
mkdir -p /var/lib/geomap
chown geomap:geomap /var/lib/geomap

# 2. Install the scripts
cp geomap.py /usr/bin/geomap.py
cp geofw.py /usr/bin/geofw.py
chmod +x /usr/bin/geomap.py /usr/bin/geofw.py

# 3. Install the template
mkdir -p /usr/share/geofw
cp geoblock.nft.j2 /usr/share/geofw/

# 4. Fetch GeoIP data
geomap.py rir -o /var/lib/geomap

# 5. Generate and load rules (example: allow DE, AT, CH only)
mkdir -p /etc/nftables.d
geofw.py -c DE,AT,CH -a accept --log -o /etc/nftables.d/geoblock.nft
nft -f /etc/nftables.d/geoblock.nft

# 6. Install systemd timer for weekly updates
cp systemd/system/geomap.service /etc/systemd/system/
cp systemd/system/geomap.timer /etc/systemd/system/
systemctl daemon-reload
systemctl enable --now geomap.timer

GPLv3 — see LICENSE for details.