Ill do! Yes, its only IP ranges, heres a snippet:
57.144.120.0/23
57.144.122.0/23
66.220.144.0/20
66.220.144.0/21
66.220.152.0/21
69.63.176.0/20
102.132.119.0/24
102.132.120.0/24
102.132.121.0/24
102.132.122.0/24
102.132.123.0/24
102.132.124.0/24
Btw: the test IP txt from the ISP is:
192.168.40.1/24
2a03:2880:f164::/48
and the settings is dest_ip from he test traffic-rule, too, but with this IP set the block is working.
You know what 100% packet loss means? :-)))
└──╼ $ping 185.60.217.35
PING 185.60.217.35 (185.60.217.35) 56(84) bytes of data.
From 192.168.100.1 icmp_seq=1 Destination Port Unreachable
From 192.168.100.1 icmp_seq=2 Destination Port Unreachable
From 192.168.100.1 icmp_seq=3 Destination Port Unreachable
From 192.168.100.1 icmp_seq=4 Destination Port Unreachable
From 192.168.100.1 icmp_seq=5 Destination Port Unreachable
From 192.168.100.1 icmp_seq=6 Destination Port Unreachable
From 192.168.100.1 icmp_seq=7 Destination Port Unreachable
From 192.168.100.1 icmp_seq=8 Destination Port Unreachable
From 192.168.100.1 icmp_seq=9 Destination Port Unreachable
From 192.168.100.1 icmp_seq=10 Destination Port Unreachable
From 192.168.100.1 icmp_seq=11 Destination Port Unreachable
From 192.168.100.1 icmp_seq=12 Destination Port Unreachable
^C
--- 185.60.217.35 ping statistics ---
12 packets transmitted, 0 received, +12 errors, 100% packet loss, time 11243ms
┌─[✗]─[usr@domain]─[~]
└──╼ $ping facebook.com
PING facebook.com (185.60.217.35) 56(84) bytes of data.
From name.lan (192.168.100.1) icmp_seq=1 Destination Port Unreachable
From name.lan (192.168.100.1) icmp_seq=2 Destination Port Unreachable
From name.lan (192.168.100.1) icmp_seq=3 Destination Port Unreachable
From name.lan (192.168.100.1) icmp_seq=4 Destination Port Unreachable
From name.lan (192.168.100.1) icmp_seq=5 Destination Port Unreachable
From name.lan (192.168.100.1) icmp_seq=7 Destination Port Unreachable
From name.lan (192.168.100.1) icmp_seq=8 Destination Port Unreachable
From name.lan (192.168.100.1) icmp_seq=9 Destination Port Unreachable
From name.lan (192.168.100.1) icmp_seq=10 Destination Port Unreachable
^C
--- facebook.com ping statistics ---
10 packets transmitted, 0 received, +10 errors, 100% packet loss, time 9205ms
┌─[✗]─[usr@domain]─[~]
└──╼ $ping facebook.com
PING facebook.com (185.60.217.35) 56(84) bytes of data.
From name.lan (192.168.100.1) icmp_seq=1 Destination Port Unreachable
From name.lan (192.168.100.1) icmp_seq=2 Destination Port Unreachable
From name.lan (192.168.100.1) icmp_seq=3 Destination Port Unreachable
From name.lan (192.168.100.1) icmp_seq=4 Destination Port Unreachable
^C
--- facebook.com ping statistics ---
4 packets transmitted, 0 received, +4 errors, 100% packet loss, time 3058ms
I suczessive reenabled all the custom rules, also the browserfeatures DNS over https, and IPv6 networking, too, and it seems working for now. I dont trust the peace and think of caching, or anything strange. But it seems to work flawlessly!
I de- and reactiveated the traffic-rules for make sure this is working and everything works now. Heres nft list chain inet fw4 forward_lan again:
/ # nft list chain inet fw4 forward_lan
table inet fw4 {
chain forward_lan {
ip daddr @Facebook-IPv4Set counter packets 60 bytes 4752 jump reject_to_wan comment "!fw4: Facebook-BlockIPv4Set"
meta l4proto tcp ip daddr @Debug counter packets 0 bytes 0 jump reject_to_wan comment "!fw4: DebugIPSets"
meta l4proto udp ip daddr @Debug counter packets 0 bytes 0 jump reject_to_wan comment "!fw4: DebugIPSets"
tcp dport 80 counter packets 0 bytes 0 jump accept_to_wan comment "!fw4: http"
tcp dport 443 counter packets 9 bytes 540 jump accept_to_wan comment "!fw4: https"
tcp dport { 25, 465, 993, 4190 } counter packets 0 bytes 0 jump accept_to_wan comment "!fw4: smtps, imap"
tcp dport { 22, 7777 } counter packets 0 bytes 0 jump accept_to_wan comment "!fw4: ssh"
udp dport 123 counter packets 0 bytes 0 jump accept_to_wan comment "!fw4: ntp"
udp dport 1194 counter packets 0 bytes 0 jump accept_to_wan comment "!fw4: openVPN"
udp dport 51820 counter packets 0 bytes 0 jump accept_to_wan comment "!fw4: wireguard"
tcp dport 5222 counter packets 0 bytes 0 jump accept_to_wan comment "!fw4: xmpp"
tcp dport 11371 counter packets 0 bytes 0 jump accept_to_wan comment "!fw4: openPGP Schlüsselserver"
counter packets 9 bytes 26544 jump drop_to_wan comment "!fw4: Blocke alles"
jump accept_to_wan comment "!fw4: Accept lan to wan forwarding"
jump accept_to_lan
}
}
ip daddr @Facebook-IPv4Set counter packets 60 bytes 4752 jump reject_to_wan comment "!fw4: Facebook-BlockIPv4Set"
Maybe some thoughts on this whole thing later. But this right now: I'm really glad and fortune, that I'm able to keep the whole company out of my network now. But as mentioned above from dharmik parmar fb and all the other bigtechs will change this on a regular basis. So that whole thing needs maintenance. So, I will try out all other options for blocking and controlling network traffic, too. Ĺike DNS IPSets filter. And surely I will take a look on ipBAN. Some tests will follow.
Thank you and all the other helpers here! 
Hopefully we dont see us again with this SetsIP-Rule-Traffic-Firewall-Stuff. 
