nft-blackhole - ArchWiki

Jump to content

This article or section is a candidate for merging with nftables.

Notes: Why copy github README, and why just not include mention of your software as simple 2 line in nftables, see Template:App? (Discuss in Talk:Nft-blackhole)

nft-blackhole - script / daemon to blocking IP in nftables by country and black lists.

## Features

- download publicly available blacklists and block IPs from them,
- block or whitelist individual countries,
- whitelist individual networks or IP addresses,

## Installation

Install the nft-blackholeAUR package.

## Configuration file

In the configuration file /etc/nft-blackhole.conf you can define:

- IP versions supported (ipv4, ipv6),
- blocking policy (reject, drop,)
- network or IP addresses for the white list,
- blacklist url addresses,
- list of countries, policy for countries (accept, block)

## Usage

Start/enable the `nft-blackhole.service` unit.

### List counter packages dropped/accept

    # nft list chain inet blackhole input

### List table and sets for blackhole

    # nft list table inet blackhole

### Refresh lists

This can be done manually by reloading `nft-blackhole.service`. Start/enable `nft-blackhole-reload.timer` to automatically refresh lists using a systemd timer. This can also be done via a crontab:

    0 */6 * * * systemctl reload nft-blackhole.service

Category:

- Firewalls

Hidden category:

- Pages or sections flagged with Template:Merge