EmergingThreats Compromised IPs

banIP (recommended)

1. Install the package: opkg update && opkg install banip luci-app-banip
2. Open LuCI → Services → banIP → Feeds and add a custom feed with the URL below.
3. Enable the feed and click Save & Apply.

https://rules.emergingthreats.net/blockrules/compromised-ips.txt

Manual with nftables

wget -qO /tmp/blocklist.txt "https://rules.emergingthreats.net/blockrules/compromised-ips.txt"
nft add set inet fw4 blocklist { type ipv4_addr; flags interval; }
nft -f - <<EOF
$(awk '!/^[#;]/ && NF {print "add element inet fw4 blocklist { " $1 " }"}' /tmp/blocklist.txt)
EOF
nft add rule inet fw4 forward ip saddr @blocklist drop

OpenWrt (banIP) Dokumentation

ipset create blocklist hash:net -exist
curl -fsSL "https://rules.emergingthreats.net/blockrules/compromised-ips.txt" | grep -Eo '^[0-9]{1,3}(.[0-9]{1,3}){3}(/[0-9]{1,2})?' | 
  while read -r net; do ipset add blocklist "$net" -exist; done
iptables -I INPUT  -m set --match-set blocklist src -j DROP
iptables -I FORWARD -m set --match-set blocklist src -j DROP

Persist the set and re-run the download from cron to keep it current:

ipset save blocklist -f /etc/ipset.blocklist
# /etc/cron.daily/blocklist

iptables / ipset Dokumentation

Add the list as an ipset in /etc/firehol/firehol.conf:

ipset4 create blocklist hash:net
ipset4 addfile blocklist "https://rules.emergingthreats.net/blockrules/compromised-ips.txt"
blacklist4 full inface any src ipset:blocklist

Reload with firehol try and confirm before making it permanent.

FireHOL Dokumentation

1. Go to Firewall → Aliases and click +.
2. Choose type URL Table (IPs), set a refresh interval (for example 1 day) and paste the URL below.
3. Save and apply, then use the alias as source in a block rule under Firewall → Rules.

https://rules.emergingthreats.net/blockrules/compromised-ips.txt

OPNsense (Firewall-Aliase) Dokumentation

1. Go to Firewall → pfBlockerNG → IP → IPv4 and click Add.
2. Paste the URL below as source, set State to ON and pick the action (Deny Both is the usual choice).
3. Save, then run Update → Force Reload → IP.

https://rules.emergingthreats.net/blockrules/compromised-ips.txt

pfSense (pfBlockerNG IP) Dokumentation

curl -fsSL "https://rules.emergingthreats.net/blockrules/compromised-ips.txt" -o /var/lib/suricata/data/blocklist.txt

Reference the file from a rule using a dataset:

alert ip [!$HOME_NET] any -> $HOME_NET any (msg:"EmergingThreats Compromised IPs match"; 
  ip.src; dataset:isset,blocklist, type string, load blocklist.txt; sid:1000001;)

Suricata / IDS Dokumentation