Home Explore Help
Sign In
kotoyuuko
/
ansible-proxy-chain
1
0
Fork 0
Files Issues 0 Pull Requests 0 Wiki
Tree: 97025df341
Branches Tags
ansible-proxy-c...
/
openspec
/
changes
/
archive
/
2026-04-22-block-cn-destinations
/
proposal.md

proposal.md 1.0 KB
History Raw

Why

Both proxy servers should refuse to forward traffic to China-destined IPs. Since clients already access Chinese services directly (per the china-direct-bypass Surge rules), any China-bound traffic reaching the servers is either misconfigured or unwanted. Blocking it server-side adds a defense-in-depth layer and prevents the servers from being used to access domestic Chinese services.

What Changes

  • Create a new Ansible role geoblock that downloads China IP CIDR lists and configures iptables to drop outbound traffic to those ranges
  • Apply the role to both relay and landing servers
  • Set up a cron job to periodically refresh the IP list

Capabilities

New Capabilities

  • geoblock-cn: Server-side blocking of outbound connections to China IP ranges via iptables

Modified Capabilities

(none)

Impact

  • New roles/geoblock/ Ansible role applied to all servers
  • iptables rules added on both servers blocking outbound to CN IP ranges
  • Cron job for periodic IP list updates
  • site.yml updated to include the geoblock role