So I just completed firewalling the entirety of China proper.
This is a geographic based IP exclusion and does not include all of the various subnets they've purchased on networks outside their country because so many people hate their lying ass Wuhan COVID-19 coronavirus guts.
I am actively pursuing those networks supplying them access outside of China and firewalling them along and along.
The subnets are many and the complicient ISPs can run, but they can't hide.