FireHOL

Health v2 · maintenance only

Adoption not part of the score

1603 stars · 192 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

FireHOL is a Linux firewall management tool built on iptables/ipsets, paired with a repository of IP blocklists dynamically updated via the update-ipsets.sh script. It aggregates threat intelligence feeds (attacks, malware, command-and-control, abuse sources) into ipsets usable directly in firewall rules.

Use cases

• block known malicious IPs at my firewall
• automatically update IP blocklists on a Linux server
• protect my server from attackers and botnets
• use threat intelligence feeds with iptables
• manage iptables firewall rules with a simple config
• block spam and brute-force source IPs

When to choose

• you run Linux servers and want curated, auto-updating IP blocklists in netfilter
• you want a declarative firewall configuration on top of iptables/ipsets
• you need to aggregate many threat feeds into performant ipsets

When to avoid

• you need a firewall solution for non-Linux platforms
• you want an application-layer or proxy-based WAF rather than IP-level filtering
• you require a GUI-managed firewall

Facets

application · maturity active

security networking developer-tools cli security networking self-hosted developer-tools cli self-hosted firewall ipset blocklist iptables netfilter threat-intelligence shell linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="firehol/firehol")