https://raw.githubusercontent.com/borestad/blocklist-abuseipdb/main/abuseipdb-s100-30d.ipv4 Open raw list Description
AbuseIPDB collects abuse reports and scores every address with a confidence value. This build takes only the addresses scored at the full 100 percent within the last 30 days, so it is far stricter than the complete view and correspondingly light on false positives. Each line carries the country and autonomous system as a comment.
Integration
- Go to Firewall → pfBlockerNG → DNSBL → DNSBL Groups (or IP for IP lists).
- Click Add, give the group a name and add the URL below as source (Format: Auto).
- Save, then run Update → Force Reload.
https://raw.githubusercontent.com/borestad/blocklist-abuseipdb/main/abuseipdb-s100-30d.ipv4Address list per script
Fetch the list and import it into an address list called blocklist:
/tool fetch url="https://raw.githubusercontent.com/borestad/blocklist-abuseipdb/main/abuseipdb-s100-30d.ipv4" dst-path=blocklist.rsc
/import blocklist.rscIf the list is a plain text file with one address or CIDR per line, convert it first:
/tool fetch url="https://raw.githubusercontent.com/borestad/blocklist-abuseipdb/main/abuseipdb-s100-30d.ipv4" dst-path=blocklist.txt
:foreach line in=[/file get blocklist.txt contents] do={
/ip firewall address-list add list=blocklist address=$line comment="AbuseIPDB (100% confidence, 30 days)"
}Use the list in the firewall
/ip firewall filter add chain=forward src-address-list=blocklist action=drop comment="AbuseIPDB (100% confidence, 30 days)"
/ip firewall filter add chain=forward dst-address-list=blocklist action=drop comment="AbuseIPDB (100% confidence, 30 days)"Schedule the fetch with /system scheduler to keep the list current. Very large lists consume RAM, so check the available memory of your device first.
banIP (recommended)
- Install the package:
opkg update && opkg install banip luci-app-banip - Open LuCI → Services → banIP → Feeds and add a custom feed with the URL below.
- Enable the feed and click Save & Apply.
https://raw.githubusercontent.com/borestad/blocklist-abuseipdb/main/abuseipdb-s100-30d.ipv4Manual with nftables
wget -qO /tmp/blocklist.txt "https://raw.githubusercontent.com/borestad/blocklist-abuseipdb/main/abuseipdb-s100-30d.ipv4"
nft add set inet fw4 blocklist { type ipv4_addr; flags interval; }
nft -f - <<EOF
$(awk '!/^[#;]/ && NF {print "add element inet fw4 blocklist { " $1 " }"}' /tmp/blocklist.txt)
EOF
nft add rule inet fw4 forward ip saddr @blocklist dropipset create blocklist hash:net -exist
curl -fsSL "https://raw.githubusercontent.com/borestad/blocklist-abuseipdb/main/abuseipdb-s100-30d.ipv4" | grep -Eo '^[0-9]{1,3}(.[0-9]{1,3}){3}(/[0-9]{1,2})?' |
while read -r net; do ipset add blocklist "$net" -exist; done
iptables -I INPUT -m set --match-set blocklist src -j DROP
iptables -I FORWARD -m set --match-set blocklist src -j DROPPersist the set and re-run the download from cron to keep it current:
ipset save blocklist -f /etc/ipset.blocklist
# /etc/cron.daily/blocklist
Add the list as an ipset in /etc/firehol/firehol.conf:
ipset4 create blocklist hash:net
ipset4 addfile blocklist "https://raw.githubusercontent.com/borestad/blocklist-abuseipdb/main/abuseipdb-s100-30d.ipv4"
blacklist4 full inface any src ipset:blocklistReload with firehol try and confirm before making it permanent.
- Go to Firewall → Aliases and click +.
- Choose type URL Table (IPs), set a refresh interval (for example 1 day) and paste the URL below.
- Save and apply, then use the alias as source in a block rule under Firewall → Rules.
https://raw.githubusercontent.com/borestad/blocklist-abuseipdb/main/abuseipdb-s100-30d.ipv4- Go to Firewall → pfBlockerNG → IP → IPv4 and click Add.
- Paste the URL below as source, set State to ON and pick the action (Deny Both is the usual choice).
- Save, then run Update → Force Reload → IP.
https://raw.githubusercontent.com/borestad/blocklist-abuseipdb/main/abuseipdb-s100-30d.ipv4curl -fsSL "https://raw.githubusercontent.com/borestad/blocklist-abuseipdb/main/abuseipdb-s100-30d.ipv4" -o /var/lib/suricata/data/blocklist.txtReference the file from a rule using a dataset:
alert ip [!$HOME_NET] any -> $HOME_NET any (msg:"AbuseIPDB (100% confidence, 30 days) match";
ip.src; dataset:isset,blocklist, type string, load blocklist.txt; sid:1000001;)