OpenWrt

Drop the list on your router with an nftables set in fw4.

OpenWrt 22.03 and later use fw4, built on nftables, and include any .nft file you drop into /etc/nftables.d/ inside its table. Define a set there, drop it early, and fill it from cron.

Set it up

1. Create the set and the drop rule in /etc/nftables.d/10-isipsafe.nft:

   set isipsafe4 {
       type ipv4_addr
       flags interval
       auto-merge
   }
   
   chain isipsafe_drop {
       type filter hook prerouting priority raw; policy accept;
       iifname "wan" ip saddr @isipsafe4 counter drop
   }

   Change wan if your WAN device has another name (for example pppoe-wan), then run fw4 reload.
2. Save the updater as /usr/bin/isipsafe-update and chmod +x it. It uses uclient-fetch, which every OpenWrt has:

   #!/bin/sh
   KEY="sl_your_key_here"
   URL="https://isipsafe.com/api/v1/blocklist?key=$KEY&format=txt&ipVersion=4&confidenceMinimum=90&limit=50000"
   uclient-fetch -q -O /tmp/isipsafe.txt "$URL" || exit 1
   {
     echo "flush set inet fw4 isipsafe4"
     awk 'NF {printf "add element inet fw4 isipsafe4 { %s }\n", $1}' /tmp/isipsafe.txt
   } > /tmp/isipsafe.nft
   nft -f /tmp/isipsafe.nft && logger -t isipsafe "loaded $(wc -l < /tmp/isipsafe.txt) addresses"

3. Run it hourly and after firewall reloads: add 0 * * * * /usr/bin/isipsafe-update to System › Scheduled Tasks, and /usr/bin/isipsafe-update to System › Startup › Local Startup. A fw4 reload empties the set until the next run.

Check with nft list set inet fw4 isipsafe4 | head and the counter in nft list chain inet fw4 isipsafe_drop.

Prefer a package? banIP can load the same URL as a custom feed and handles IPv6 and logging for you.

Need a hand?

If something here does not work with your version of OpenWrt, or you have improved it, tell us. We update these pages with what people send.

OpenWrt and its logo are trademarks of their respective owners. isipsafe is not affiliated with or endorsed by them.