Skip to content

Firehol Blocklists

Firehol blocklists are a collection of automatically updating ipsets from all available security IP Feeds, mainly related to on-line attacks, on-line service abuse, malwares, botnets, command and control servers and other cybercrime activities.



Install the following packages:

sudo apt install ipset iprange

Firehol Blocklists

Navigate to Firehol's website or Firehol's github repo and choose which blocklists you want to enable.

Copy the raw links into /home/user/firehol/firehol.conf. For example:

Firehol Script

Create a script to refresh the firehol ipsets and recreate the iptables rules.

For example /home/user/firehol/


URLS=$(cat "/home/user/firehol/firehol.conf")
echo "Updating Firehol $(date)" >> $LOG

iptables -D INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT > /dev/null 2>&1
iptables -D DOCKER-USER -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT > /dev/null 2>&1
iptables -D FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT > /dev/null 2>&1
iptables -I FORWARD 1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT >> $LOG
iptables -I INPUT 1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT >> $LOG
iptables -I DOCKER-USER 1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT >> $LOG

for URL in $URLS
    echo $URL >> $LOG
    NAME=$(basename $URL)
    echo $NAME >> $LOG
    curl -s -k $URL > $FILE
    # The following sed removes LAN ranges from the lists otherwise you might block yourself
    sed -i -e 's#' -e 's#' -e 's#' -e 's#' $FILE
    COUNT=$(/usr/bin/iprange -C $FILE)
    echo $COUNT >> $LOG
    /usr/sbin/ipset create --exist $NAME hash:net family inet maxelem 131072 >> $LOG
    /usr/sbin/ipset flush $NAME > /dev/null 2>&1
    /usr/bin/iprange $FILE --ipset-reduce 20 --ipset-reduce-entries 65535 --print-prefix "-A $NAME " > $FILE.ipset
    /usr/sbin/ipset restore --exist --file $FILE.ipset >> $LOG
    /usr/sbin/iptables -D FORWARD -m set --match-set $NAME src -j DROP &>/dev/null
    /usr/sbin/iptables -D INPUT -m set --match-set $NAME src -j DROP &>/dev/null
    /usr/sbin/iptables -D DOCKER-USER -m set --match-set $NAME src -j DROP &>/dev/null
    /usr/sbin/iptables -I DOCKER-USER 2 -m set --match-set $NAME src -j DROP >> $LOG
    /usr/sbin/iptables -I INPUT 2 -m set --match-set $NAME src -j DROP >> $LOG
    /usr/sbin/iptables -I FORWARD 2 -m set --match-set $NAME src -j DROP >> $LOG

Verify that it works and the ipsets have been filled:

chmod +x /home/user/firehol/
sudo /home/user/firehol/
sudo ipset list firehol_level1.netset

Cron Scheduling

Warning - make sure you're not accidentally blocking your own access to the VPS before proceeding.

Run the firehol script on reboot and daily.

For example, add the following to sudo crontab -e:

0 1 * * * /home/user/firehol/
@reboot sleep 120 && /home/user/firehol/

Verify that it runs on reboot and daily. There's a 2 minute delay before it applies after reboots, to give you enough time to fix a lockout.



Navigate to Firewall > Aliases and create the following aliases:

Name: Firehol
Type: URL IPs
Name: External
Type: Networks
Content: !, !, !, !
Name: Firehol_without_internal
Type: Network group
Content: External, Firehol


Navigate to Firewall > Rules > WAN and create the following firewall rule:

Action: Block
Interface: WAN
Direction: in
TCP/IP Version: IPv4
Protocol: any
Source: Firehol_without_internal
Destination: any


Create a cron job to automatically update the blocklists every day.

Navigate to System > Settings > Cron and add the following job:

Eabled: checked
Minutes: 0
Hours: 0
Day of the month: *
Months: *
Days of the week: *
Command: Update and reload firewall aliases

Last update: 2024-05-06
Created: 2024-04-24