> eBPF & XDP would be much faster than netfilter. Netfilter is plenty fast, when configured sensibly. You'd probably want script to populate a "hash:net" ipset

> eBPF & XDP would be much faster than netfilter. Netfilter is plenty fast, when configured sensibly. You'd probably want script to populate a "hash:net" ipset instead, and have just one iptables rule: -A INPUT \ -m set --match-set geoblock \ -j DROP (where "geoblock" is aforementioned set)