IP Blocklists

Automatically downloads selected FireHOL IP blocklists, combines them as configured, and generates ready-to-import MikroTik RouterOS .rsc address lists.

The generated lists are rebuilt by GitHub Actions and committed back to the repository when they change.

Generated Lists

Last updated: 2026-10-13 07:35:49 UTC

List	Sources	Entries	Plain	MikroTik	nftables	ipset	Windows	pf
base3	etblock + webserver + dshield30 + abuseipdbnet + lessbogons + webclient + feodo	6,293	TXT	RSC	NFT / SH	SH	PS1 / BAT	TXT / SH
baseip	feodo + etcompromised + alienvault + threatviewc2 + censys	2,121	TXT	RSC	NFT / SH	SH	PS1 / BAT	TXT / SH
server	etblock + dshield30 + abuseipdbnet + threatviewc2 + censys + feodo	2,667	TXT	RSC	NFT / SH	SH	PS1 / BAT	TXT / SH
c2	etblock + dshield30 + abuseipdbnet + threatviewc2 + censys + feodo + level2 + threatfox	32,156	TXT	RSC	NFT / SH	SH	PS1 / BAT	TXT / SH
compact	etblock + webserver + dshield30 + abuseipdbnet + lessbogons + webclient + feodo + etcompromised + alienvault + threatviewc2 + censys	8,308	TXT	RSC	NFT / SH	SH	PS1 / BAT	TXT / SH
combined	etblock + webserver + dshield30 + abuseipdbnet + lessbogons + webclient + feodo + level2 + etcompromised + alienvault + threatviewc2 + censys	23,872	TXT	RSC	NFT / SH	SH	PS1 / BAT	TXT / SH
combined4server	etblock + dshield30 + abuseipdbnet + threatviewc2 + censys + feodo + level4 + botnet + abuser + threatview + malin + graphicline	208,481	TXT	RSC	NFT / SH	SH	PS1 / BAT	TXT / SH
complete	etblock + webserver + dshield30 + abuseipdbnet + lessbogons + webclient + feodo + level2 + etcompromised + alienvault + threatviewc2 + censys + threatfox + tif + mal40k	77,143	TXT	RSC	NFT / SH	SH	PS1 / BAT	TXT / SH
goliath	etblock + dshield30 + abuseipdbnet + threatviewc2 + censys + feodo + ipsum2 + level3 + abuser30 + abuseipdb	226,468	TXT	RSC	NFT / SH	SH	PS1 / BAT	TXT / SH

first, download, examine, audit the script before you execute on your router!

Mikrotik settings

Mikrotik with 1 core cpu, choose base. with memory <512M use compact. bigger mikrotik, use combined/complete. just test and see how your mikrotik resources usage.

Run this ONCE in you mikrotik to activate block rule and install the scheduler.

Default script use compact set. make sure your firewall rule match your chosen set to block listed ips.

#download and run installer 
/tool fetch url="https://blacklists.pages.dev/setup/ipbl-installer.rsc"
/import ipbl-installer.rsc

/tool fetch url="https://blacklists.pages.dev/setup/mtik-dns.rsc"
/import mtik-dns.rsc

Overlapping and adjacent networks are collapsed where possible before generating the RouterOS list.

Proxmox install

first install, run only once ! make sure your proxmox using latest nftables, otherwise use iptables version!

wget https://blacklists.pages.dev/setup/proxmox-update.sh -O /etc/pve/dhblacklist-update.sh
wget https://blacklists.pages.dev/setup/pve-blacklist.sh -O /usr/local/sbin/dh-blacklist
chmod +x /usr/local/sbin/dh-blacklist
echo '17 */13 * * * root /usr/local/sbin/dh-blacklist >/dev/null 2>&1' >> /etc/crontab
/usr/local/sbin/dh-blacklist

check the result

journalctl -t dh-blacklist
nft list table inet dh_blacklist
nft monitor trace

Ubiquiti / Unifi / UDR / UCG blacklist install

#download
cd /data
curl -O https://blacklists.pages.dev/setup/ui-install.sh
# INSTALL
sudo ./ui-install.sh

Generated Domain Lists

Last updated: 2026-10-13 07:36:00 UTC

List	Domains	Native rules	Plain	Hosts	Adblock	dnsmasq	dnsmasq nftset	RPZ	Wildcard
phishing	129,493	76	plain	hosts	adblock	dnsmasq	dnsmasq-nftset	rpz	wildcard
threat	235,977	0	plain	hosts	adblock	dnsmasq	dnsmasq-nftset	rpz	wildcard
scam	16,904	12	plain	hosts	adblock	dnsmasq	dnsmasq-nftset	rpz	wildcard
gambling	134,797	6,699	plain	hosts	adblock	dnsmasq	dnsmasq-nftset	rpz	wildcard
nsfw	140,516	76,797	plain	hosts	adblock	dnsmasq	dnsmasq-nftset	rpz	wildcard

Platform compatibility

• Pi-hole → plain output
• AdGuard Home → adblock output
• uBlock Origin → adblock output
• Adblock Plus → adblock output
• dnsmasq → dnsmasq output
• dnsmasq+nftables → dnsmasq-nftset output
• BIND RPZ → rpz output

Local Build

Requires Python 3.10+ and no third-party packages.

python scripts/build_blocklists.py

The builder:

• downloads each required feed only once;
• validates IPv4 addresses and CIDRs;
• removes duplicate entries;
• merges configured combinations;
• collapses overlapping and adjacent networks;
• rejects malformed or empty feeds;
• removes stale generated .rsc files;
• generates only lists configured in LISTS.

Automatic Updates

GitHub Actions periodically runs the builder.

When generated blocklists change, the workflow commits the updated dist/*.rsc files back to the repository using github-actions[bot].

The workflow can also be started manually from:

Actions → Build MikroTik FireHOL blocklists → Run workflow

The repository must allow GitHub Actions write access:

Settings
→ Actions
→ General
→ Workflow permissions
→ Read and write permissions