Tangential, but this reminds me of a problem I've had with pf tables. But for other reasons, and with FreeBSD. On a FreeBSD server, using pf, I wanted to open

Tangential, but this reminds me of a problem I've had with pf tables. But for other reasons, and with FreeBSD. On a FreeBSD server, using pf, I wanted to open one port to only IP addresses from two specific countries[1], and disallow from everywhere else. Everything else is behind a VPN, but I'm managing this server for other people, and, for some reason, a WireGuard VPN is a no (this would have instantly solved the problem). So then, why a whole country? Because searching for a way to auto-allow their specific /32 public IP addresses each time they changed sounded like a PITA. So, rejected. So I went and created pf tables for allowing whole-country address ranges, this was the easy part. But then I couldn't get FreeBSD to stop complaining about the tables being too large, even after tweaking some sysctl settings and stuff. I don't remember the actual size, but at the very least the plaintext file that contained one subnet per line, could fit in my 64GB RAM with a lot of room to spare. I just gave up for now and told them to use SSH forwarding on a bastion server, which is an option they accept. [1]: Yes, I know, this isn't bulletproof. I just want to reduce noise from spray-and-pray bs on my SSH and HTTPS logs.