> ## Documentation Index
> Fetch the complete documentation index at: https://verifyngo.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Filter traffic by ASN with whois or GeoLite2 lookups

> Use RADb whois lookups or a MaxMind GeoLite2 ASN database to expand ASN numbers into IP prefixes that policy rules can match against.

When you write a policy rule that references an `asn:` entry, verifyngo needs to know which IP ranges belong to that ASN. It can find them in two ways: by querying RADb via whois (enabled by default, no setup required), or by using a local MaxMind GeoLite2 ASN database file. You can use either method on its own, or both together.

## RADb whois lookup (default)

verifyngo queries `whois.radb.net:43` at startup for each ASN referenced in your policy's `networks` section. No API key or external account is needed. The returned prefixes are loaded into memory and used for all subsequent request matching.

<ParamField body="whois_enabled" type="boolean" default="true">
  Enables RADb whois lookups. Set to `false` to disable whois-based prefix resolution entirely.
</ParamField>

<ParamField body="whois_addr" type="string" default="&#x22;whois.radb.net:43&#x22;">
  The RADb whois server address (host and port) to query.
</ParamField>

<ParamField body="whois_timeout" type="string" default="&#x22;30s&#x22;">
  Timeout for each individual whois query. Accepts Go duration strings such as `"10s"` or `"1m"`.
</ParamField>

<ParamField body="whois_strict" type="boolean" default="false">
  Controls what happens when a whois lookup fails. If `true`, a lookup failure causes verifyngo to abort startup with an error. If `false` (the default), the failure is logged as a warning and startup continues — the affected ASN simply has no prefixes loaded.
</ParamField>

```json theme={null}
"asn": {
  "whois_enabled": true,
  "whois_addr": "whois.radb.net:43",
  "whois_timeout": "30s",
  "whois_strict": false
}
```

## MaxMind GeoLite2 ASN database

If you have a MaxMind GeoLite2 ASN database file (`.mmdb`), point `geoip_db_path` at it. verifyngo will use it to resolve the ASN of each incoming IP address at request time. This is useful when the whois-based prefix list is incomplete or when you prefer real-time ASN resolution over a static prefix list built at startup.

<ParamField body="geoip_db_path" type="string">
  Path to your `GeoLite2-ASN.mmdb` file. Leave unset if you are not using a MaxMind database.
</ParamField>

```json theme={null}
"asn": {
  "geoip_db_path": "/data/GeoLite2-ASN.mmdb",
  "whois_enabled": true
}
```

<Note>
  You can sign up for a free MaxMind account at [maxmind.com](https://www.maxmind.com) to download the GeoLite2 ASN database. If you are running verifyngo with Docker, mount the file into the container as a read-only volume:

  ```bash theme={null}
  -v $(pwd)/GeoLite2-ASN.mmdb:/data/GeoLite2-ASN.mmdb:ro
  ```
</Note>

## Using ASNs in policy rules

Define your ASN-based network groups in the `networks` section of your policy file, then reference them in rule conditions using `remoteAddress.network()`.

```yaml theme={null}
networks:
  cloud-providers:
    - asn: 136907
    - asn: 55990

rules:
  - name: challenge-cloud-providers
    conditions:
      - 'remoteAddress.network("cloud-providers")'
    action: challenge
```

At startup, verifyngo expands each ASN into its IP prefixes via whois and loads them into memory. Each incoming request is then checked against those prefixes — there is no per-request DNS or whois query.