nft-blacklist.conf

# Ensure the directory for IP_BLACKLIST_FILE/RULESET_FILE exists (it won't be created automatically)
RULESET_FILE=/var/cache/nft-blacklist/blacklist.nft
IP_BLACKLIST_FILE=/var/cache/nft-blacklist/ip-blacklist.list
IP6_BLACKLIST_FILE=/var/cache/nft-blacklist/ip6-blacklist.list

# Whitelisted addresses are accepted even if they appear in the blacklist
# Because this is a simple drop-in in the nftables ruleset, keep the right coma-separated syntax
IP_WHITELIST="10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16"
IP6_WHITELIST="fe80::/10, fd00::/8"

# Sample (!) list of URLs for IP blacklists
BLACKLISTS=(
    # "file:///etc/nft-blacklist/nft-blacklist-custom.list" # optional, for your personal nemeses (no typo, plural)
    "https://check.torproject.org/cgi-bin/TorBulkExitList.py?ip=1.1.1.1" # TOR Exit Nodes
    "https://danger.rulez.sk/projects/bruteforceblocker/blist.php" # BruteForceBlocker IP List
    "https://www.spamhaus.org/drop/drop.lasso" # Spamhaus Don't Route Or Peer List (DROP)
    "https://www.spamhaus.org/drop/dropv6.txt" # Spamhaus Don't Route Or Peer List IPv6 (DROPv6)
    "https://cinsscore.com/list/ci-badguys.txt" # C.I. Army Malicious IP List
    "https://lists.blocklist.de/lists/all.txt" # blocklist.de attackers
    "https://blocklist.greensnow.co/greensnow.txt" # GreenSnow
    "https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/firehol_level1.netset" # Firehol Level 1
    # "https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/stopforumspam_7d.ipset" # Stopforumspam via Firehol
    # "https://raw.githubusercontent.com/ipverse/rir-ip/master/country/zz/ipv4-aggregated.txt" # Ban an entire country(-code), see https://github.com/ipverse/rir-ip
    # "https://raw.githubusercontent.com/ipverse/asn-ip/master/as/1234/ipv4-aggregated.txt" # Ban a specific autonomous system (ISP), see https://github.com/ipverse/asn-ip
)

# nftables dedicated table name (you probably don't have to change it)
TABLE=blackhole

# Apply ruleset while executing the script
APPLY_RULESET=yes

# Probably set to "no" for cron jobs, defaults to yes
VERBOSE=yes