Firewall integration guides.

Choose your platform

Turn the published lists into an enforceable firewall policy. Each guide covers the feed, the rule, refresh behavior and verification. Examples use Standard by default. Choose Critical when your environment needs broader blocking.

Two feeds. One format.

Each file contains one canonical IPv4 address per line, with no header, comments or duplicates. These are complete lists. No split files or API key are required. The shared whitelist is already applied to both published profiles.

Standard

94,998 unique IPv4 addresses in this published snapshot.

https://raw.githubusercontent.com/duggytuxy/Data-Shield_IPv4_Blocklist/refs/heads/main/prod_data-shield_ipv4_blocklist.txt

Critical

104,852 unique IPv4 addresses in this published snapshot.

https://raw.githubusercontent.com/duggytuxy/Data-Shield_IPv4_Blocklist/refs/heads/main/prod_critical_data-shield_ipv4_blocklist.txt

Published 21 Oct 2026, 00:05 UTC. Check live counts and SHA-256.

Counts above belong to the website snapshot generated 21 Oct 2026, 00:05 UTC. Open live downloads to check the latest publication and checksums before comparing appliance totals.

A reliable deployment, step by step

1. Check capacity first. Include all other feeds and tables already loaded on the appliance. A successful HTTP download does not prove every address was imported.
2. Keep administrative access. Back up the configuration and use a trusted management path while introducing a new policy.
3. Fetch over verified HTTPS. Configure DNS, time synchronization and the correct trust store. Fix certificate errors instead of disabling verification.
4. Match incoming source addresses. Scope the rule to your Internet ingress and protected services. Review rule ordering, port forwarding and separate rules for services hosted on the firewall.
5. Prove enforcement. Check imported entries, refresh timestamps and policy logs using a controlled connection from an address you own. Existing sessions can follow their previous state.
6. Monitor updates. Alert on fetch failures, skipped entries and capacity growth. Preserve a usable configuration so that a failed change can be reversed.

Publication is not appliance refresh

Data-Shield generates lists every two hours. The website refreshes automatically each hour and after publication. A firewall uses its own retrieval schedule, while a mirror can introduce an additional delay. Use the primary GitHub raw URL in these guides and monitor the actual successful retrieval time.

Whitelist and false positives

An address removed by the shared whitelist is excluded from both public blocklists at generation time. Your appliance must retrieve that updated file before the removal reaches its policy. Absence from a list does not create an allow rule or bypass your other firewall controls.

For an urgent local exception, use the platform's reviewed exception mechanism and record its scope and expiry. Avoid broad allow rules that bypass unrelated security checks. Use the whitelist request form to report a false positive or the block request form to submit evidence.