Back to home
OPNsense

OPNsense Firewall Integration

Configure the ThreatHive blocklist using Firewall Aliases — no packages required.

  1. Log in to the OPNsense web interface Open a browser and navigate to your firewall, e.g. https://<firewall-ip>, then sign in with your admin credentials.
  2. Create a Firewall Alias for the blocklist
    1. Go to Firewall › Aliases.
    2. Click + Add.
    3. Fill in the alias:
      • Name: ThreatHive_Blocklist
      • Type: URL Table (IPs)
      • Content: https://threathive.net/hiveblocklist.txt
      • Update Frequency: 15 Minutes
      • Description: ThreatHive.net — Malicious IPs
    4. Click Save, then Apply Changes.
  3. Create a WAN block rule
    1. Go to Firewall › Rules › WAN.
    2. Click + Add.
    3. Configure the rule:
      • Action: Block
      • Interface: WAN
      • Direction: In
      • Source: Single host or alias → ThreatHive_Blocklist
      • Destination: Any
      • Description: Block ThreatHive malicious IPs
      • Log: Recommended — enables audit trail
    4. Click Save, then Apply Changes.
  4. Enable logging and monitor live traffic
    • Enable logging on the rule created above.
    • Go to Firewall › Log Files › Live View to watch blocked IPs in real time.
  5. Verify the integration is working
    • Go to Firewall › Aliases.
    • Click the 🔍 icon next to ThreatHive_Blocklist to see the current set of blocked IPs loaded into pf.
  6. Additional notes
    • The blocklist refreshes automatically every 15 minutes — no manual action needed.
    • Check WAN rule ordering if you have other allow/deny rules; block rules should appear before broad allow rules.
    • This guide covers inbound blocking. The same alias can be referenced in outbound rules for egress filtering.