Stormshield integration guide.

Choose the supported import path

Use a custom web service containing the published IPv4 addresses, then reference it as an inbound source criterion. This workflow prepares a CSV on your workstation and imports it through the SNS interface. It does not configure an automatic HTTPS feed on the firewall.

Check the limits in the Stormshield CSV specification. The documented capacities range from 5,000 to 1,000,000 rows depending on the model and, for EVA, memory. The limit applies to the entire custom database, including existing services. A 100,000-row model has little spare room for a large Critical feed.

Download and validate the feed

Standard

94,998 unique IPv4 addresses in this published snapshot.

https://raw.githubusercontent.com/duggytuxy/Data-Shield_IPv4_Blocklist/refs/heads/main/prod_data-shield_ipv4_blocklist.txt

Critical

104,852 unique IPv4 addresses in this published snapshot.

https://raw.githubusercontent.com/duggytuxy/Data-Shield_IPv4_Blocklist/refs/heads/main/prod_critical_data-shield_ipv4_blocklist.txt

Published 21 Oct 2026, 00:05 UTC. Check live counts and SHA-256.

On your administration workstation, install Python 3.11 or later and use the Data-Shield CSV converter. Read the downloaded script before running it. It operates offline, accepts only unique canonical public IPv4 addresses from the new feed and refuses IPv6, CIDR, comments, extra characters, an incomplete final line or a database larger than the specified capacity. It does not contact your firewall.

curl --proto '=https' --tlsv1.2 --fail --show-error --max-time 60 \
  --output data-shield-stormshield.py \
  'https://data-shield.eu/downloads/data-shield-stormshield.py'
curl --proto '=https' --tlsv1.2 --fail --show-error --max-time 60 \
  --output data-shield-standard.txt \
  'https://raw.githubusercontent.com/duggytuxy/Data-Shield_IPv4_Blocklist/refs/heads/main/prod_data-shield_ipv4_blocklist.txt'

From Configuration → Objects → Web services → List of web services, export the complete custom database as existing-services.csv. Keep a separate backup. This example uses a verified capacity of 100,000 rows: replace that number with the published limit for your model.

python3 data-shield-stormshield.py \
  --input data-shield-standard.txt \
  --profile standard \
  --existing existing-services.csv \
  --max-entries 100000 \
  --output data-shield-services.csv

Only when no custom database exists, replace --existing existing-services.csv with --new-database. Existing files are never overwritten: select a new output filename for the next revision. For Critical, download the Critical URL, set --profile critical and point --input to that file.

The converter replaces only rows named datashieldstandard or datashieldcritical for the chosen profile. Other services remain in the output. It prints the validated count and source SHA-256. Review the result and compare it with the matching published snapshot before importing.

Import the complete custom database

1. Open Configuration → Objects → Web services → Import custom services and select the newly generated CSV.
2. Review the import result. Stop if there is an error, rejected record or limit warning.
3. In List of web services, inspect datashieldstandard or datashieldcritical, its address count and revision details. Check that all other custom services are still present.
4. Retain the previous complete CSV until the new database and policy have been verified.

Use the web services inspection and export controls to verify membership. The conversion step does not validate a firewall's available memory or prove that the appliance accepted the import.

Match the service on incoming sources

In Security policy → Filtering and NAT, create a dedicated block rule on the active filter policy. In the source editor, select the actual Internet ingress interface and the custom Data-Shield service under Web services and IP reputations. Its tab location depends on the SNS release. Scope destinations to your protected services, enable logs and position the block before overlapping allow rules.

Review the SNS source matching controls. Apply or activate the reviewed policy using your normal change procedure. Confirm separate management, VPN and NAT behavior for your topology.

Verify, refresh and roll back

Inspect the effective service members and log a controlled new inbound connection matching the block. Check the active policy, source criterion and action. Test with an address you control; list membership alone does not prove rule enforcement.

Refresh is manual in this guide. Repeat export, full-feed validation, merge and import after a publication you want to adopt. Export the current database each time so other administrators' changes are preserved. Shared whitelist removals take effect only after importing the corrected full set.

For automatic synchronization, validate a model- and release-specific supported deployment method with Stormshield first, including database replacement, failure recovery and HA behavior. This guide supplies no unattended importer and does not label a manual snapshot as a live feed.

For rollback, disable the new block rule and restore the previous complete custom database if needed. Verify other service-dependent policies after restoration.