pfSense integration guide.

Size the tables before import

This guide uses native aliases on pfSense CE and Plus. No additional package is required. Keep a configuration backup and a trusted management path. Select one protection profile first; loading both uses space for both aliases, including overlapping entries.

Under System → Advanced → Firewall & NAT, review Firewall Maximum Table Entries and available memory. Netgate documents a default of 400,000 entries and recommends room for at least twice the entries across all aliases so old and new tables can coexist during reload. Add headroom for other tables and growth. See Netgate's capacity and HTTPS settings.

Enable Verify HTTPS certificates when downloading alias URLs. The firewall needs DNS, correct time and a current CA trust store. Do not disable certificate checks to work around a failed download.

Create the scheduled URL table

Standard

109,308 unique IPv4 addresses in this published snapshot.

https://raw.githubusercontent.com/duggytuxy/Data-Shield_IPv4_Blocklist/refs/heads/main/prod_data-shield_ipv4_blocklist.txt

Critical

119,382 unique IPv4 addresses in this published snapshot.

https://raw.githubusercontent.com/duggytuxy/Data-Shield_IPv4_Blocklist/refs/heads/main/prod_critical_data-shield_ipv4_blocklist.txt

Published 24 Oct 2026, 12:05 UTC. Check live counts and SHA-256.

1. Open Firewall → Aliases, add an alias and name it DS_STANDARD.
2. Select URL Table (IPs). Paste the Standard feed URL and set its update interval to 1 day. For the Critical profile, use its URL and DS_CRITICAL instead.
3. Save, apply and confirm that the table populates before enabling a block rule.

Creation fields and naming restrictions are documented in Alias Configuration. Use the counts displayed above to plan capacity, then compare against the publication actually retrieved.

Apply an incoming-source block

Under Firewall → Rules, select the actual Internet ingress interface. Add an IPv4 Block rule with source DS_STANDARD, protocol any, a descriptive label and logging. Limit the destination to the protected systems or services, and place it above applicable interface pass rules. For a port-forwarded service, match the translated internal destination. Preserve the rules needed for administration.

Inspect floating and interface-group rules as well. A port forward using the Pass filter association can bypass normal filtering; use an associated filter rule and order the block before it. Netgate's firewall troubleshooting guide explains these precedence cases, and its NAT processing order explains destination translation.

Verify membership and enforcement

Open Diagnostics → Tables and select the alias, as described in Firewall Table Contents. Inspect its contents and count after the initial download and again after the next scheduled refresh. A fetch success alone does not establish complete import. With existing administrative shell access, these commands only inspect the table:

pfctl -t DS_STANDARD -T show | wc -l
pfctl -t DS_STANDARD -vT show

A table-record count is not a content checksum. Confirm specific added or removed addresses when checking an update. In Status → System Logs → Firewall, find the dedicated rule's entries for a controlled test connection. Existing states may retain the earlier decision; inspect the relevant test state without clearing unrelated connections.

Refresh, exceptions and rollback

Monitor failed downloads, empty tables and capacity growth. A publication or whitelist correction reaches this rule only after the appliance successfully refreshes its alias. If daily updates are too slow, evaluate a separately managed refresh solution instead of assuming the native interval accepts hours.

For rollback, disable the dedicated block rule, apply and verify connectivity. Remove the alias only after removing its references. Do not flush unrelated tables. This is a documentation-based procedure, not a claim of testing on your appliance.