awesome-repositories.com
Blog
MCP
awesome-repositories.com

Discover the best open-source repositories with AI-powered search.

ExploreCurated searchesOpen-source alternativesSelf-hosted softwareBlogSitemap
ProjectMCP serverAboutHow we rankPress
LegalPrivacyTerms
© 2026 Bringes Technology SRL·VAT RO45896025·hello@awesome-repositories.com
firehol avatar

firehol/blocklist-ipsets

0
View on GitHub↗

Blocklist Ipsets

This project is a security utility for aggregating threat intelligence and automating the deployment of high-performance firewall rules. It functions as an aggregator that fetches and normalizes malicious IP address lists from multiple external security feeds and a management tool that deploys these lists into the Linux kernel using ipset for packet filtering.

The system maintains network perimeter defense by using atomic kernel updates to swap IP sets, which allows firewall rules to be updated without interrupting active connections. It includes a range optimizer that simplifies network address data structures to minimize kernel overhead and improve packet inspection speed.

The tool covers broad capability areas including automated firewall management, threat intelligence synchronization, and network range optimization. It also provides monitoring and observability through a reporting system that generates a static website to track the history, age, and overlap of synchronized blocklists.

AI search

Explore more awesome repositories

Describe what you need in plain English — the AI ranks thousands of curated open-source projects by relevance.

Start searching with AI
iplists.firehol.org
↗

Features

  • Network Perimeter Defense - Provides an automated system for protecting network boundaries by maintaining up-to-date kernel-level firewall rules.
  • Malicious Traffic Blocking - Provides a system for blocking network traffic from known malicious IP addresses and subnets at the kernel level.
  • Threat Intelligence Normalizations - Normalizes diverse external threat intelligence formats into a standard representation for firewall application.
  • IP Set Management - Manages and injects IP address sets directly into the Linux kernel for high-performance packet filtering.
  • Firewall Blocklist Automators - Automates the periodic download and application of remote threat intelligence lists to firewall rules.
  • IPSet Managers - Automates the deployment of curated IP blocklists into the Linux kernel using ipset for high-performance filtering.
  • Threat Intelligence Aggregation - Aggregates and normalizes malicious IP address lists from multiple external security feeds.
  • Threat Intelligence Synchronizers - Synchronizes threat intelligence data and malicious IP blocklists from multiple remote sources.
  • Feed Downloader and Normalizers - Implements a pipeline to fetch and normalize malicious IP blocklists from multiple external security feeds.
  • IP Range Optimizations - Optimizes network address ranges to minimize kernel overhead and increase packet inspection speed.
  • Kernel-Level IP Set Optimizations - Structures network address data for high-performance lookups within kernel-level firewall filtering mechanisms.
  • Atomic Rule Update Mechanisms - Implements zero-downtime firewall policy updates by swapping data sets in memory to prevent network interruptions.
  • Kernel Set Synchronizers - Uses atomic kernel set swapping to ensure continuous traffic flow during firewall policy updates.
  • Network Security - A collection of IP blocklists for network security.
  • Security Auditing - Manager for downloading and installing cybercrime IP feed sets.
3,850 stars·420 forks·Shell·25 views

Star history

Star history chart for firehol/blocklist-ipsetsStar history chart for firehol/blocklist-ipsets

How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.

Frequently asked questions

What does firehol/blocklist-ipsets do?

This project is a security utility for aggregating threat intelligence and automating the deployment of high-performance firewall rules. It functions as an aggregator that fetches and normalizes malicious IP address lists from multiple external security feeds and a management tool that deploys these lists into the Linux kernel using ipset for packet filtering.

What are the main features of firehol/blocklist-ipsets?

The main features of firehol/blocklist-ipsets are: Network Perimeter Defense, Malicious Traffic Blocking, Threat Intelligence Normalizations, IP Set Management, Firewall Blocklist Automators, IPSet Managers, Threat Intelligence Aggregation, Threat Intelligence Synchronizers.

Which projects share features with firehol/blocklist-ipsets?

Projects with overlapping indexed features include: stamparm/maltrail — Maltrail is a malicious traffic detection system used for network intrusion detection. It consists of a network… mitchellkrogza/nginx-ultimate-bad-bot-blocker — This project is a collection of configuration files and scripts serving as a bot blocker and security middleware for… irbis-sh/zen-desktop — Zen Desktop is a cross-platform proxy client and network request filter for Windows, macOS, and Linux. It functions as… alexandreborges/malwoverview — This project is a Python command-line security tool and malware analysis framework designed for threat intelligence… kickstarter/rack-attack — This project is a Rack middleware rate limiter and application layer firewall for Ruby web applications. It serves as… loveshell/ngx_lua_waf — ngx_lua_waf is an OpenResty web application firewall that uses Lua to filter malicious HTTP requests and block web…

Projects sharing features with Blocklist Ipsets

These projects share indexed features with Blocklist Ipsets. Shared tags can include platform or build tooling; verify the primary use case before treating a result as a replacement.
  • stamparm/maltrailstamparm avatar

    stamparm/maltrail

    8,498View on GitHub↗

    Maltrail is a malicious traffic detection system used for network intrusion detection. It consists of a network intrusion sensor for monitoring interfaces, a threat intelligence aggregator for syncing blacklists, and a detection engine that identifies security threats through signature matching and heuristic attack patterns. The system distinguishes itself through a distributed sensor architecture that collects traffic data from multiple remote probes and forwards events to a central analysis server. It employs heuristic behavioral analysis to identify unknown threats, such as port scanning o

    Pythonattack-detectionintrusion-detectionmalware
    View on GitHub↗8,498
  • mitchellkrogza/nginx-ultimate-bad-bot-blockermitchellkrogza avatar

    mitchellkrogza/nginx-ultimate-bad-bot-blocker

    4,750View on GitHub↗

    This project is a collection of configuration files and scripts serving as a bot blocker and security middleware for Nginx. It functions as an automated blocklist manager that filters malicious user-agents and IP addresses to mitigate vulnerability scanning, login brute-forcing, and DDoS attacks. The system distinguishes itself by automating the maintenance of security rules, downloading updated bot definitions and reloading the server on a schedule. It also includes a search engine spam filter capable of generating robots.txt files and link disavow lists to prevent malicious domains from imp

    Shelladwarebot-blockerbots
    View on GitHub↗4,750
  • irbis-sh/zen-desktopirbis-sh avatar

    irbis-sh/zen-desktop

    4,058View on GitHub↗

    Zen Desktop is a cross-platform proxy client and network request filter for Windows, macOS, and Linux. It functions as a system-wide ad blocker and privacy protection tool that intercepts network traffic across all operating system applications to block advertisements, trackers, and malware. The software employs a network request filtering system that modifies HTTP headers and prunes JSON data using custom rules and regular expressions. It specifically removes tracking parameters and sanitizes network headers to prevent activity monitoring. The project provides capabilities for blocklist man

    Goad-blockadblockadblocker
    View on GitHub↗4,058
  • kickstarter/rack-attackkickstarter avatar

    kickstarter/rack-attack

    5,744View on GitHub↗

    This project is a Rack middleware rate limiter and application layer firewall for Ruby web applications. It serves as a security layer to throttle and block HTTP requests based on custom rules, protecting web servers from abusive traffic. The system provides capabilities for IP blocking and the banning of malicious clients. It implements request safelisting to bypass restrictions for trusted users and uses time-windowed rate limiting to control request frequency. The middleware covers traffic management and monitoring, including the ability to track request patterns and instrument traffic ev

    Ruby
    View on GitHub↗5,744
Compare all 30 related projects→