Comment by ornornor
3 years ago
Curious: why not routing and vpn? I do this with opnsense, for instance Pandora is forbidden where I live so I’ve looked up all IPs for their ASN and made routing rules that any packet going to these IPs go over the US VPN. And I’ve made WireGuard profiles for mobile phones so the Pandora traffic goes over WireGuard and through the us vpn via my home opnsense.
I did this for several years before but it was a constant maintenance burden because as third party services were integrated or removed over time. Eventually as AWS and third-party CDN usage grew routing by subnet was just not feasible.
Didn't consider smaller services hosted on AWS. Subnet routing only works well for those that have their own ASN indeed.