IPFire integration guide.

Check the installed Core Update

IPFire's IP Address Blocklists feature exists from Core Update 170. This advanced guide was reviewed against the official stable source at d37aca7cfd4c62d04b4033e5a0a3a8bad9ce510e, identifying itself as IPFire 2.29 Core 205. It uses the native downloader and firewall integration, with two locally maintained source definitions. It does not install the older third-party blocklist add-on.

Back up the firewall configuration and keep console or trusted management access. Allow enough RAM for both complete sets plus a temporary replacement set during an update. The reviewed downloader limits each response to 10 MiB; check file sizes as the feeds grow. The native policy checks source addresses arriving on RED and destination addresses leaving RED; this is broader than an inbound-only rule. Review effects on required outbound services.

Register both complete IPv4 feeds

Standard

112,177 unique IPv4 addresses in this published snapshot.

https://raw.githubusercontent.com/duggytuxy/Data-Shield_IPv4_Blocklist/refs/heads/main/prod_data-shield_ipv4_blocklist.txt

Critical

121,738 unique IPv4 addresses in this published snapshot.

https://raw.githubusercontent.com/duggytuxy/Data-Shield_IPv4_Blocklist/refs/heads/main/prod_critical_data-shield_ipv4_blocklist.txt

Published 26 Oct 2026, 21:31 UTC. Check live counts and SHA-256.

As an administrator, make a dated backup of /var/ipfire/ipblocklist/sources outside the live path. Edit a copy first. Preserve all packaged entries and its package IPblocklist::List; declaration. Add the following assignments after the existing closing );, once only. These are Perl source entries, not shell commands. The URLs are the same primary GitHub feeds used throughout this handbook.

# Local Data-Shield entries, after the existing sources hash.
$sources{'DS_STANDARD'} = {
    'name' => 'Data-Shield Standard',
    'url' => 'https://raw.githubusercontent.com/duggytuxy/Data-Shield_IPv4_Blocklist/refs/heads/main/prod_data-shield_ipv4_blocklist.txt',
    'info' => 'https://data-shield.eu/docs/ipfire/',
    'parser' => 'ip-or-net-list',
    'rate' => '2h',
    'category' => 'composite'
};
$sources{'DS_CRITICAL'} = {
    'name' => 'Data-Shield Critical',
    'url' => 'https://raw.githubusercontent.com/duggytuxy/Data-Shield_IPv4_Blocklist/refs/heads/main/prod_critical_data-shield_ipv4_blocklist.txt',
    'info' => 'https://data-shield.eu/docs/ipfire/',
    'parser' => 'ip-or-net-list',
    'rate' => '2h',
    'category' => 'composite'
};
1;

Run perl -c on the edited copy before installing it with the original ownership and permissions. Do not load executable source definitions obtained from an unreviewed feed. This change adds catalogue metadata only; downloaded list content remains plain text.

1. Open Firewall → IP Address Blocklists. Enable the feature and select Data-Shield Standard and Data-Shield Critical, or only the profile you intend to enforce.
2. Save, then apply pending changes on the firewall rules page. Keep other selections unchanged.
3. Wait for the native updater and verify both live sets. Do not substitute a custom firewall.local ruleset or flush unrelated tables.

Both profiles overlap. Loading them separately preserves their identities; enabling both enforces their union, not twice the protection. The catalogue mechanism is described by the original feature author in IPFire's source-definition discussion.

Use the existing automatic updater

The reviewed fcron configuration in config/cron/crontab invokes update-ipblocklists every 15 minutes while RED is active. The 2h source field controls eligibility for retrieval; it is not a promise of execution on an exact wall-clock boundary. Leave the existing scheduler in place rather than adding a second job.

The native downloader in config/cfgroot/ipblocklist-functions.pl checks the HTTPS hostname and CA bundle, uses conditional requests and converts accepted lines into an IPv4 set. Fix trust, DNS and clock errors without disabling TLS validation. Its parser can skip invalid lines; it does not compare the response with Data-Shield's published SHA-256. A successful message alone does not establish a complete import.

The updater in src/scripts/update-ipblocklists loads a replacement set and swaps it into service. Each successful complete refresh replaces membership, allowing removed addresses to leave the local blocklist. Inspect set-load errors as well as download errors; a saved file or success log is not proof that the kernel accepted every entry.

Verify membership and enforcement

ipset list DS_STANDARD -terse
ipset list DS_CRITICAL -terse
iptables -L DS_STANDARD_DROP -n -v
iptables -L DS_CRITICAL_DROP -n -v

Compare each set's entry count with its complete downloaded publication, allowing for a newer generation than the website snapshot. Use ipset test DS_STANDARD IP_ADDRESS and ipset test DS_CRITICAL IP_ADDRESS, replacing the placeholder with actual current members. Test a removed member after a later refresh too. Review ipblocklist messages and native firewall logs, then prove filtering with controlled traffic from an address you own. Existing connections and other rules can affect the observed path.

After a reboot, firewall reload or Core Update, repeat the catalogue, scheduler, set and counter checks. Track last successful retrieval separately from source modification timestamps. Do not assume an ordinary allow rule bypasses native blocklist enforcement. For a false positive, use the publication and whitelist workflow or review an appliance-specific exception.

For rollback, unselect only these two sources, save and apply changes before removing their catalogue assignments. Preserve other source entries and firewall settings. This guide is based on source review and syntax validation, not appliance certification.