[geeks] .hk, .cn, .info considered harmful

[der Mouse]

> I'm really not that concerned about mail here.  [...]  I'm looking
> for a simple way to drop all traffic from these TLDs at the firewall.

Part of your problem, then, is that you're trying for something
ill-defined.

Domains don't emit traffic; addresses do.  Whether a given packet comes
from a given TLD is not well-defined.  The mapping between addresses
and domains is very, very far from a bijection.

It sounds to me as though you're actually trying for something more
like traffic emitted from machines physically in the countries in
question, but even that is fairly hard; some networks are
geographically quite dispersed.

This is not to say that what you're trying to do can't be approximated
closely enough to be useful.  Just that looking for a precise way to do
something imprecisely defined is rather pointless.

/~\ The ASCII				der Mouse
\ / Ribbon Campaign
 X  Against HTML	       mouse at rodents.montreal.qc.ca
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B