Blocklists – Integration Guide

Every list is available in three variants; replace <id> with the ID from the table:

• IPv4 and IPv6: https://ipv64.net/blocklists/ipv64_blocklist_<id>.txt
• IPv4 only: https://ipv64.net/blocklists/ipv64_blocklist_v4_<id>.txt
• IPv6 only: https://ipv64.net/blocklists/ipv64_blocklist_v6_<id>.txt
• MikroTik RouterOS: https://ipv64.net/blocklists/v64_mikrotik_v4_<id>.rsc and …_v6_<id>.rsc

Format: one address or network (CIDR) per line, no comments. The lists are regenerated several times a day. Please fetch them at most every 30 minutes; every 1 to 6 hours is enough. Country and continent lists are on the list page. For scripts: index.json lists every list with count, last update, source, license and file names.

https://ipv64.net/blocklists/live/<token>/ipv64_blocklist_v4_v64.txt

For current Debian, Ubuntu, Fedora, Proxmox and most routers on Linux. The script loads IPv4 and IPv6 into a separate table inet ipv64 and replaces it atomically. It does not touch your other rules. If a download fails, the old list stays active. Traffic forwarded to Docker containers or NATed hosts is filtered too.

Install (as root):

apt install -y nftables curl
curl -fsSo /usr/local/sbin/ipv64-blocklist-nft.sh https://ipv64.net/blocklists/tools/ipv64-blocklist-nft.sh
chmod +x /usr/local/sbin/ipv64-blocklist-nft.sh
/usr/local/sbin/ipv64-blocklist-nft.sh firehole_l1

Update every 4 hours and after a reboot (cron):

cat > /etc/cron.d/ipv64-blocklist <<'EOF'
17 */4 * * * root /usr/local/sbin/ipv64-blocklist-nft.sh firehole_l1 >/dev/null
@reboot      root sleep 30 && /usr/local/sbin/ipv64-blocklist-nft.sh firehole_l1 >/dev/null
EOF

Check and remove:

nft list chain inet ipv64 input     # counters show dropped packets
nft delete table inet ipv64          # remove the blocklist completely

#!/bin/sh
# IPv64.net blocklist for nftables (IPv4 + IPv6) - https://ipv64.net/v64_blocklist_integration_guide
# Usage: ipv64-blocklist-nft.sh [list]   (default: firehole_l1, see https://ipv64.net/v64_blocklists)
# Run as root. Replaces table "inet ipv64" atomically; on a failed download the old sets stay active.
set -eu
LIST="${1:-firehole_l1}"
BASE="https://ipv64.net/blocklists"
TMP="$(mktemp -d)"
trap 'rm -rf "$TMP"' EXIT

for v in 4 6; do
	curl -fsS --max-time 120 -o "$TMP/raw$v" "$BASE/ipv64_blocklist_v${v}_${LIST}.txt"
	# only keep lines that look like an address or network
	grep -E '^[0-9A-Fa-f:.]+(/[0-9]{1,3})?$' "$TMP/raw$v" > "$TMP/v$v" || true
done
if [ ! -s "$TMP/v4" ] && [ ! -s "$TMP/v6" ]; then
	echo "ipv64-blocklist: download empty, keeping the active sets" >&2
	exit 1
fi

elements() { # file -> "elements = { a, b, ... }" (nothing for an empty file)
	[ -s "$1" ] || return 0
	printf '\t\telements = { '
	paste -sd, "$1" | sed 's/,/, /g'
	printf ' }\n'
}

{
	echo "table inet ipv64"
	echo "delete table inet ipv64"
	echo "table inet ipv64 {"
	printf '\tset bl4 {\n\t\ttype ipv4_addr\n\t\tflags interval\n\t\tauto-merge\n'
	elements "$TMP/v4"
	printf '\t}\n\tset bl6 {\n\t\ttype ipv6_addr\n\t\tflags interval\n\t\tauto-merge\n'
	elements "$TMP/v6"
	printf '\t}\n'
	# drop traffic FROM listed networks to this host and to forwarded/NATed hosts (routers, Docker)
	printf '\tchain input {\n\t\ttype filter hook input priority -10; policy accept;\n\t\tip saddr @bl4 counter drop\n\t\tip6 saddr @bl6 counter drop\n\t}\n'
	printf '\tchain forward {\n\t\ttype filter hook forward priority -10; policy accept;\n\t\tip saddr @bl4 counter drop\n\t\tip6 saddr @bl6 counter drop\n\t}\n'
	echo "}"
} > "$TMP/ipv64.nft"

nft -f "$TMP/ipv64.nft"
echo "ipv64-blocklist: $LIST loaded ($(wc -l < "$TMP/v4") IPv4, $(wc -l < "$TMP/v6") IPv6 entries)"

For systems that still use iptables. The script fills one set each for IPv4 and IPv6 via ipset restore, swaps it in and adds the DROP rules only once (INPUT, FORWARD and, if present, Docker's DOCKER-USER chain).

apt install -y ipset iptables curl
curl -fsSo /usr/local/sbin/ipv64-blocklist-ipset.sh https://ipv64.net/blocklists/tools/ipv64-blocklist-ipset.sh
chmod +x /usr/local/sbin/ipv64-blocklist-ipset.sh
/usr/local/sbin/ipv64-blocklist-ipset.sh firehole_l1
echo '17 */4 * * * root /usr/local/sbin/ipv64-blocklist-ipset.sh firehole_l1 >/dev/null' > /etc/cron.d/ipv64-blocklist
echo '@reboot root sleep 30 && /usr/local/sbin/ipv64-blocklist-ipset.sh firehole_l1 >/dev/null' >> /etc/cron.d/ipv64-blocklist

The @reboot line restores sets and rules after a restart, so ipset-persistent is not needed. Docker restarts its chains when the daemon restarts; run the script again afterwards.

#!/bin/sh
# IPv64.net blocklist for iptables + ipset (IPv4 + IPv6) - https://ipv64.net/v64_blocklist_integration_guide
# Usage: ipv64-blocklist-ipset.sh [list]   (default: firehole_l1, see https://ipv64.net/v64_blocklists)
# Run as root. Loads the list into a new set and swaps it in; on a failed download the old set stays active.
set -eu
LIST="${1:-firehole_l1}"
BASE="https://ipv64.net/blocklists"
TMP="$(mktemp -d)"
trap 'rm -rf "$TMP"' EXIT

for v in 4 6; do
	fam=inet; ipt=iptables
	[ "$v" = 6 ] && { fam=inet6; ipt=ip6tables; }
	set="ipv64-v$v"; new="ipv64-v$v-new"
	curl -fsS --max-time 120 -o "$TMP/raw" "$BASE/ipv64_blocklist_v${v}_${LIST}.txt"
	grep -E '^[0-9A-Fa-f:.]+(/[0-9]{1,3})?$' "$TMP/raw" > "$TMP/list" || true
	n=$(wc -l < "$TMP/list")
	if [ "$n" -eq 0 ] && [ "$v" = 4 ]; then
		echo "ipv64-blocklist: IPv4 download empty, keeping the active set" >&2
		exit 1
	fi
	ipset create -exist "$set" hash:net family "$fam" maxelem 1048576
	ipset destroy "$new" 2>/dev/null || true
	{ echo "create $new hash:net family $fam maxelem 1048576"; sed "s/^/add $new /" "$TMP/list"; } | ipset restore -exist
	ipset swap "$new" "$set"
	ipset destroy "$new"
	# rules only once: -C checks whether the rule exists already
	for chain in INPUT FORWARD; do
		$ipt -C "$chain" -m set --match-set "$set" src -j DROP 2>/dev/null || $ipt -I "$chain" -m set --match-set "$set" src -j DROP
	done
	# Docker publishes ports through DOCKER-USER, not INPUT
	if $ipt -nL DOCKER-USER >/dev/null 2>&1; then
		$ipt -C DOCKER-USER -m set --match-set "$set" src -j DROP 2>/dev/null || $ipt -I DOCKER-USER -m set --match-set "$set" src -j DROP
	fi
	echo "ipv64-blocklist: $set ($LIST) loaded with $n entries"
done

1. Firewall › Aliases › URLs › Add: Type URL Table (IPs), name e.g. IPv64_firehol, URL https://ipv64.net/blocklists/ipv64_blocklist_firehole_l1.txt, update frequency 1 day. Save and Apply Changes.
2. Firewall › Rules › WAN › Add (arrow up = top): Action Block, Address Family IPv4+IPv6, Protocol Any, Source: Single host or alias = IPv64_firehol, Destination any. Save and apply.
3. Optional, recommended for Spamhaus DROP: Firewall › Rules › LAN, Block rule at the top with Destination = the alias. This stops infected devices from contacting the listed networks.

Large lists (countries) may exceed Firewall Maximum Table Entries under System › Advanced › Firewall & NAT; raise the value if the alias stays empty. Diagnostics › Tables shows the loaded entries. pfSense checks URL tables once per day, so the live state of the v64 lists brings no advantage here.

1. Firewall › Aliases › +: Type URL Table (IPs), name e.g. IPv64_firehol, refresh frequency 0 days 4 hours, content https://ipv64.net/blocklists/ipv64_blocklist_firehole_l1.txt. Save and Apply.
2. Firewall › Rules › WAN › +: Action Block, Direction in, TCP/IP Version IPv4+IPv6, Protocol any, Source = IPv64_firehol, Destination any. Save, drag the rule to the top and apply.
3. Optional on LAN: Block rule with Destination = alias (outbound).

Firewall › Diagnostics › Aliases shows the loaded entries and the last update.

These firewalls load a plain text list from a URL themselves. Steps follow the vendor documentation (PAN-OS 11.1, FortiOS 7.6, Sophos Firewall 21.5). The examples use the v64 Blocklist; every other list works the same way. For the live state enter the address with your list token. Set the update interval to 30 minutes or more – FortiGate refreshes every 5 minutes by default.

Palo Alto Networks (PAN-OS): External Dynamic List

1. Objects › External Dynamic Lists › Add: name e.g. IPv64_v64, Type IP List, Source https://ipv64.net/blocklists/ipv64_blocklist_v64.txt, optionally a Certificate Profile with the CA of the ipv64.net certificate (server authentication), Check for updates Hourly. OK.
2. Policies › Security › Add: on the Source tab the list as Source Address (inbound from the Internet zone), Action Deny. Move the rule above your allow rules. For outbound traffic, use the list as Destination Address in a second rule.
3. Commit. Import Now on the list fetches it immediately.

PAN-OS accepts IPv4 and IPv6 addresses, ranges and networks. All IP lists together may hold 50,000 addresses on most models (150,000 on PA-3200, PA-5200 and PA-7000); see List Capacities under Objects › External Dynamic Lists. If the server cannot be reached, the firewall keeps the last list.

Fortinet FortiGate (FortiOS): IP address feed

1. Security Fabric › External Connectors › Create New, under External Feeds (older versions: Threat Feeds) choose IP Address: name e.g. IPv64_v64, URL of external resource https://ipv64.net/blocklists/ipv64_blocklist_v64.txt, Refresh Rate 60 minutes. OK.
2. Policy & Objects › Firewall Policy: rule from the WAN interface with Source = the feed (section IP ADDRESS FEED), Action DENY, above the allow rules. For outbound traffic, a rule with the feed as Destination.

The same on the CLI, plus a local-in policy that also protects the FortiGate itself (VPN, admin access); use a free policy number:

config system external-resource
    edit "IPv64_v64"
        set type address
        set resource "https://ipv64.net/blocklists/ipv64_blocklist_v64.txt"
        set refresh-rate 60
        set server-identity-check full
    next
end
config firewall local-in-policy
    edit 100
        set intf "any"
        set srcaddr "IPv64_v64"
        set dstaddr "all"
        set service "ALL"
        set schedule "always"
    next
end

FortiOS accepts IPv4 and IPv6 addresses, ranges and networks, one per line. server-identity-check checks the server certificate (default none).

Sophos Firewall: Third-party threat feeds

1. Active threat response › Third-party threat feeds › Add: name e.g. IPv64_v64, Action Block, Indicator type IPv4 address, External URL https://ipv64.net/blocklists/ipv64_blocklist_v4_v64.txt, Authorization No authentication, Validate server certificate on, Polling interval 1 hour (or 30 minutes). Save.
2. Synchronize now loads the feed immediately; check the log for matches.

Requires the license for third-party threat feeds (Xstream Protection). According to Sophos, these feeds take single IPv4 addresses only, no IPv6, ranges or networks. The ipv64.net lists contain networks and write single addresses as /32; whether Sophos accepts these entries has not been tested. XGS 87, 88 and 107 offer only 24 hours, 7 days or 30 days as polling interval.

ipv64.net provides ready-made import files. Each file first removes its own old entries and then adds the current ones to the address list IPv64-<id>. The following script downloads the file, imports it and is run by the scheduler every 6 hours. Paste it into the terminal (Winbox › New Terminal):

/system script add name=ipv64-blocklist policy=read,write,test source={
  :foreach v in={"v4";"v6"} do={
    :local f ("ipv64-" . $v . ".rsc")
    /tool fetch url=("https://ipv64.net/blocklists/v64_mikrotik_" . $v . "_firehole_l1.rsc") dst-path=$f
    :delay 2s
    /import file-name=$f
    /file remove $f
  }
}
/system scheduler add name=ipv64-blocklist interval=6h start-time=startup on-event="/system script run ipv64-blocklist"
/system script run ipv64-blocklist
/ip firewall raw add chain=prerouting src-address-list=IPv64-firehole_l1 action=drop comment="IPv64 blocklist"
/ipv6 firewall raw add chain=prerouting src-address-list=IPv64-firehole_l1 action=drop comment="IPv64 blocklist"

The raw rules drop the traffic before connection tracking, for the router and the LAN. Move them to the top of the raw table if you have other raw rules. The import of large lists takes a few seconds. /ip firewall address-list print count-only where list=IPv64-firehole_l1 shows the number of entries. For the live state of the v64 Blocklist use the URL ("https://ipv64.net/blocklists/live/<token>/v64_mikrotik_" . $v . "_v64.rsc"), the list name IPv64-v64 and interval=30m.

For a web server or reverse proxy without firewall access. The geo module checks networks efficiently, even with tens of thousands of entries. Blocked clients get HTTP 403.

1. Fetch the list as a geo file (cron, e.g. every 4 hours):

curl -fsS https://ipv64.net/blocklists/ipv64_blocklist_blocklistde_all.txt \
  | awk '/^[0-9A-Fa-f:.]+(\/[0-9]+)?$/ {print $1" 1;"}' > /etc/nginx/ipv64-geo.conf.new \
  && [ -s /etc/nginx/ipv64-geo.conf.new ] && mv /etc/nginx/ipv64-geo.conf.new /etc/nginx/ipv64-geo.conf \
  && nginx -t -q && systemctl reload nginx

2. Use it in nginx.conf:

http {
    geo $ipv64_blocked { default 0; include /etc/nginx/ipv64-geo.conf; }
    server {
        # ...
        if ($ipv64_blocked) { return 403; }
    }
}

Behind Cloudflare or another proxy, configure real_ip_header first, otherwise nginx sees the proxy address.

Import the list as decisions; all your bouncers (firewall, nginx, Traefik …) apply it. The decisions expire after 6 hours, so import again every 4 hours via cron:

curl -fsSo /tmp/ipv64.txt https://ipv64.net/blocklists/ipv64_blocklist_firehole_l1.txt \
  && cscli decisions import -i /tmp/ipv64.txt --format values --duration 6h --reason ipv64-blocklist

The Node64 container uses the IPv64 blocklists in its reverse proxy CDN64 with one click: CDN64 › Access › Blocklists. It refreshes them every 30 minutes and lets you define exceptions. With your list token stored there, it loads the v64 lists live.

ipv64.net combines and cleans public lists: it converts everything to networks, removes duplicates, contained networks and reserved ranges. The entries themselves come from these projects:

• Spamhaus DROP
• FireHOL Level 1
• blocklist.de
• DShield (SANS ISC)
• Tor Project
• abuse.ch Feodo Tracker (CC0)
• Emerging Threats
• CINS Army
• IPsum (Unlicense)
• DoH-IP-blocklists (GPL-3.0)
• Honeypot64 (ipv64.net, CC BY 4.0): v64 Blocklist and its parts
• Cloud networks as published by Cloudflare, AWS, Google Cloud

If one of your addresses is listed by mistake, ask the source project to remove it; the change reaches the IPv64 lists with the next update. For the v64 lists, request the removal in the IP lookup. The lists are free to use; please respect the terms of the source projects and do not use them as the only protection.