firehol-blacklist(5)

💖 firehol-blacklist — the manual page, but make it bestie 💖

okay so you found firehol-blacklist(5) (yes that's the manual name, section 5, we're in the config-helpers zone ✨) and honestly? it's giving "I will block that IP so hard it forgets its own MAC address". let's go 🫶

---

🌸 NAME 🌸

firehol-blacklist — set up a unidirectional or bidirectional blacklist 💅

---

✨ SYNOPSIS ✨

{ blacklist | blacklist4 | blacklist6 } [ type ] [ inface device ] [ log
"text" ] [ nolog ] [ connlog "text" ] [ loglimit "text" ] [ accounting
accounting_name ] ip...  [ except rule-params [or rule-params [or ...
]]]

like. that's the whole vibe. three names, a pile of optional sparkles, a bunch of IPs, and a lil except escape hatch at the end. 🎀

---

🦋 DESCRIPTION 🦋

the blacklist helper command creates a blacklist for the ip list you give it (and yes, you can wrap that list in quotes or not, she does not care, she is flexible like that 💁‍♀️).

if the type full or all is supplied (or you don't supply a type at all, because defaults are also a choice bestie), a bidirectional stateless blacklist gets generated. the firewall will REJECT all traffic going to the IP addresses and DROP all traffic coming from them. no cap. 🔥

if the type stateful is supplied, a bidirectional stateful blacklist gets generated. and, plot twist, the firewall will REJECT all traffic going to the IP addresses and DROP all traffic coming from them. same energy, different machinery, okurrr 💀

the differences between full and stateful are, in numbered-list format because we are thorough:

1. stateful is resource efficient, since only the packets that initiate connections are examined. established connections will never be re-tested against the blacklist. she is low-maintenance, she is chill 🌿
2. when using full and an ipset is updated to match the IP of an established connection, this established connection will immediately be blocked too. she is not chill. she is watching. 👀

if the type input or him, her, it, this, these is supplied, a unidirectional stateful blacklist gets generated. connections can be established to such IP addresses, but those IP addresses will not be able to connect to the firewall or to hosts protected by it. so it's like... you can call them, they cannot call you. main character boundaries 🧚‍♀️

using log (log every packet), connlog (log connections once), or loglimit (log packets according to global throttling settings), the text will be logged when matching packets are found. receipts. 📝

using nolog will disable logging for this rule. sometimes we move in silence 🤫

using inface, the blacklist will be created on the interface device only (and yes, this includes forwarded traffic). 🌈

accounting will update the NFACCT accounting with the name given. numbers go up, slay 📊

if the keyword except is found, then all the parameters following it are rules to match packets that should be excluded from the blacklist (i.e. they are a whitelist for this blacklist). it's the VIP list, the "not you boo" list 💖. see firehol-params(5) for more details.

⚠️ IMPORTANT, DO NOT SKIP THIS ONE: blacklists must be declared before the first router or interface. like, before. the ordering is not a suggestion, it is the law 👑

IP Lists for abuse, malware, attacks, proxies, anonymizers, etc can be downloaded with the contrib/update-ipsets.sh script. information about the supported IP Lists can be found at FireHOL IP Lists. go get your list, bestie, they're free and they're spicy 🌶️

---

🎀 EXAMPLES 🎀

blacklist full 192.0.2.1 192.0.2.2
blacklist input "192.0.2.3 192.0.2.4"
blacklist full inface eth0 log "BADGUY" 192.0.1.1 192.0.1.2

see how the second one has the IPs in quotes and the first one doesn't? both valid, she contains multitudes 💜

---

👑 SEE ALSO 👑

• firehol(1) — FireHOL program
• firehol.conf(5) — FireHOL configuration
• FireHOL Website
• FireHOL Online PDF Manual
• FireHOL Online Documentation
• FireHOL IP Lists

---

🌟 AUTHORS 🌟

FireHOL Team. iconic. legendary. the moment. 🫶

---

and that's the page!! this was FireHOL Reference, built 13 Apr 2025, version 3.1.8 energy — mwah, go block something, stay safe, drink water 🍓✨