Filter traffic by ASN with whois or GeoLite2 lookups

Use RADb whois lookups or a MaxMind GeoLite2 ASN database to expand ASN numbers into IP prefixes that policy rules can match against.

When you write a policy rule that references an asn: entry, verifyngo needs to know which IP ranges belong to that ASN. It can find them in two ways: by querying RADb via whois (enabled by default, no setup required), or by using a local MaxMind GeoLite2 ASN database file. You can use either method on its own, or both together.

RADb whois lookup (default)

verifyngo queries whois.radb.net:43 at startup for each ASN referenced in your policy’s networks section. No API key or external account is needed. The returned prefixes are loaded into memory and used for all subsequent request matching.

whois_enabled · boolean · default: "true"

Enables RADb whois lookups. Set to false to disable whois-based prefix resolution entirely.

whois_addr · string · default: "\"whois.radb.net:43\""

The RADb whois server address (host and port) to query.

whois_timeout · string · default: "\"30s\""

Timeout for each individual whois query. Accepts Go duration strings such as "10s" or "1m".

whois_strict · boolean · default: "false"

Controls what happens when a whois lookup fails. If true, a lookup failure causes verifyngo to abort startup with an error. If false (the default), the failure is logged as a warning and startup continues — the affected ASN simply has no prefixes loaded.

"asn": {
  "whois_enabled": true,
  "whois_addr": "whois.radb.net:43",
  "whois_timeout": "30s",
  "whois_strict": false
}

MaxMind GeoLite2 ASN database

If you have a MaxMind GeoLite2 ASN database file (.mmdb), point geoip_db_path at it. verifyngo will use it to resolve the ASN of each incoming IP address at request time. This is useful when the whois-based prefix list is incomplete or when you prefer real-time ASN resolution over a static prefix list built at startup.

geoip_db_path · string

Path to your GeoLite2-ASN.mmdb file. Leave unset if you are not using a MaxMind database.

"asn": {
  "geoip_db_path": "/data/GeoLite2-ASN.mmdb",
  "whois_enabled": true
}

You can sign up for a free MaxMind account at maxmind.com to download the GeoLite2 ASN database. If you are running verifyngo with Docker, mount the file into the container as a read-only volume:

-v $(pwd)/GeoLite2-ASN.mmdb:/data/GeoLite2-ASN.mmdb:ro

Using ASNs in policy rules

Define your ASN-based network groups in the networks section of your policy file, then reference them in rule conditions using remoteAddress.network().

networks:
  cloud-providers:
    - asn: 136907
    - asn: 55990

rules:
  - name: challenge-cloud-providers
    conditions:
      - 'remoteAddress.network("cloud-providers")'
    action: challenge

At startup, verifyngo expands each ASN into its IP prefixes via whois and loads them into memory. Each incoming request is then checked against those prefixes — there is no per-request DNS or whois query.