Help4 Realtime IP Blocklist - Firewall Integration

Live TXT feed: https://control.help4.net/v1/public/rbl.txt
Live JSON feed: https://control.help4.net/v1/public/rbl
View and download: https://help4.net/status.html#realtime-rbl
License: https://help4.net/rbl-license.html

The TXT feed contains one exact IPv4 or IPv6 address per line. It is an HTTPS
blocklist, not a DNS mail-RBL lookup zone. Replace the list regularly to remove
expired entries. A successful empty response is a valid empty set. Do not merge
every new generation into a permanent list. Retain the previous valid set and
alert on failed refreshes. For precise expiry use JSON blockExpiresAt.

pfSense:
  Firewall > Aliases > URLs: create Help4_RBL as URL Table (IPs), using the
  live TXT URL. Select a supported regular refresh interval, save and apply.
  Use Help4_RBL as the source of a scoped inbound Block rule, or as the
  destination of a scoped outbound Block rule. Preserve management exceptions.
  Check table contents and rule counters. Disable the Help4 rule to roll back.
  Native pfSense URL tables check on a daily schedule; use a separately
  qualified updater when faster removal of expired listings is required.
  https://docs.netgate.com/pfsense/en/latest/firewall/aliases-types.html

OPNsense:
  Firewall > Aliases: create Help4_RBL as URL Table (IPs). Set Content to the
  live TXT URL and configure regular refresh. Save and apply. Reference it in
  a scoped Block rule. Verify Firewall > Diagnostics > Aliases and counters.
  Disable the Help4 rule to roll back.
  https://docs.opnsense.org/manual/aliases.html

FortiGate:
  Security Fabric > External Connectors (Fabric Connectors on some firmware):
  create an IP Address threat feed named Help4_RBL. Set URI of external resource
  to the TXT URL and a supported refresh interval. Reference the object in a
  scoped deny firewall policy before the corresponding allow policy, keeping
  management exceptions earlier. Verify connector state, address count and logs.
  Disable only the Help4 deny policy to roll back.
  https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/891236/ip-address-threat-feed

Linux nftables / ipset:
  Use dedicated IPv4 and IPv6 sets and rules scoped to the intended traffic.
  Fetch the JSON feed with HTTPS certificate verification; validate schema,
  freshness, exact addresses and entry expiry. Build a replacement set then
  commit it atomically (nftables transaction or ipset swap). Never evaluate or
  execute downloaded feed content. Schedule updates no faster than the feed's
  refreshSeconds and expire timed entries at blockExpiresAt. Keep previous
  valid sets on download/validation failure and alert. Preserve trusted local
  administration, VPN and emergency-access exceptions.
  https://wiki.nftables.org/wiki-nftables/index.php/Sets

Exports from the site use the selected address family. Search filters affect
only the displayed table. Test changes on a scoped interface before expanding.
Listings describe observed rejected traffic; they do not identify a person.

Attribution required by the published license:
Threat intelligence provided by Help4 Realtime RBL (https://help4.net/status.html#realtime-rbl).
Read the full license for eligible uses and governmental-use restrictions.