Seems desirable offhand, as bad values could ruin your day.
Easier checks, likely of limited use:
- Entropy (most likely changes since last load)
- Block size (v4/v6)
- Reserved blocks (another alias)
Possible actions:
- Block update (do not update table/alias)
- Filter matching elements
- Alert (send some sort of notification, perhaps combined with block/filter)
The only really useful sanity check I can think of would be to match accessed IPs. That is, keep a history of the n most common source and destination IPs passing through the firewall (stateful only), and match alias elements to that history. OPNsense has top ten sources/destinations, but I'd be looking at n=(a lot more), and preservation through reboots. Could be a fairly expensive feature (memory, possibly computation).
Thoughts?