@hrbrmstr My concern there is that the CDN is basically a class A of v4 addresses and an equally giant amount of v6. Over time the table could hold hundreds or thousands of allowed addresses.
@thedarktangent ipset is pretty efficient
@hrbrmstr What I meant was that over time the rule would become less and less effective. Soon it would allow my server to connect out to hundreds or thousands of IP addresses on a public CDN network, when it really needs to only talk to a single IP for a few seconds.
@thedarktangent @hrbrmstr the nftset can have an expiry time associated with it, entries not touched get pruned.
For eg a curl “one and done” lookup+connect, set the timeout to say 5s, long enough for the 3-way handshake to end up in conntrack, then you can drop the entry, established connections are usually allowed to continue.