AS_Network_List/blacklists_nftables/blacklist-vk-v6.nft

# Autogenerated nftables blacklist
# Generated: 2026-03-27T06:59:36.677644Z
# Source: /home/runner/work/AS_Network_List/AS_Network_List/blacklists/blacklist-vk-v6.txt
# IPv4: 0, IPv6: 1
#
# Usage:
#   sudo nft -f <this-file>
#   # VK egress blocking for VPN clients via NAT/FORWARD
#   sudo nft add chain inet filter forward '{ type filter hook forward priority 0; policy accept; }'
#   sudo nft add rule inet filter forward iifname "<VPN_IFACE>" ip daddr @blacklist_vk_v4 counter reject
#   sudo nft add rule inet filter forward iifname "<VPN_IFACE>" ip6 daddr @blacklist_vk_v6 counter reject

table inet filter {

    set blacklist_vk_v4 {
        type ipv4_addr
        flags interval
    }

    set blacklist_vk_v6 {
        type ipv6_addr
        flags interval
        elements = {
            2a00:bdc0::/29
        }
    }

    chain input {
        type filter hook input priority 0;
        policy accept;

        ct state { established, related } accept

        ip6 saddr @blacklist_vk_v6 counter drop
    }
}