Browse docs

Firewalls

OPNsense setup

Configure Cybora threat feeds in OPNsense as URL Table Aliases and use them in firewall rules to block malicious IP infrastructure.

Last updated: September 2, 2026

On this page

Use this guide to integrate Cybora with OPNsense using native firewall aliases. In OPNsense, the cleanest native workflow is to consume Cybora as an IP-based URL Table alias and then use that alias in firewall rules.

What OPNsense can do with a Cybora feed

  • OPNsense can fetch remote IP feeds into a URL Table alias and keep the alias updated automatically.
  • The imported alias can then be used in firewall rules anywhere you would normally use a host or network alias.
  • Domain feeds can be added separately through the Unbound DNS blocklist function.
  • Cybora URL feeds containing complete URLs or paths can’t be imported directly through OPNsense aliases or Unbound DNS blocklists. URL-path filtering requires a separately configured web proxy and a different integration format.

Choose the correct integration for each feed type

  • IPv4: Under Firewall > Aliases, select URL Table (IPs) and use a Cybora feed URL with type=ipv4. Here, “URL” refers to the download location. The downloaded file must still contain IP addresses. Don’t select URL (IPs), because that type only downloads the list once, or URL Table in JSON format (IPs), because Cybora delivers plain text rather than JSON.
  • Domain: Don’t select an option from the alias type dropdown. Add the feed URL with type=domain under Services > Unbound DNS > Blocklists in URLs of Blocklists instead.
  • URL: The Cybora type=url feed isn’t directly compatible with this alias workflow. URL Table (IPs) doesn’t accept complete URLs; it only downloads IP addresses from a URL. The JSON variant also extracts IP addresses, so providing the same URL indicators as JSON wouldn’t solve this limitation. OPNsense can filter domains and URL paths through an optional web proxy such as os-OPNProxy, but that requires separate proxy configuration, HTTPS inspection for complete encrypted paths, and a proxy-compatible feed integration.

Before you start

  • Use an OPNsense release that supports Firewall > Aliases and URL Table aliases.
  • Make sure the firewall can reach your Cybora feed URL over HTTPS.
  • Use an IP-based Cybora feed for the native OPNsense alias workflow.
  • The remote feed should stay in plain text format with one IP address per line.

Create the alias

The alias overview under Firewall > Aliases is the starting point. Select the plus button to create a new alias.

OPNsense alias overview with the plus button highlighted for adding an alias

  1. Go to Firewall > Aliases and add a new alias.
  2. Enter a clear alias name and description.
  3. Set the alias type to URL Table (IPs).
  4. Paste your Cybora feed URL into the content field.
  5. Set the Refresh frequency to match your Cybora plan as closely as your OPNsense setup allows. Do not poll the feed more often than your plan permits. Only one request is allowed within the permitted interval, and excessive polling may cause the feed to be blocked.
  6. Save the alias and apply the changes.

The following example uses the URL Table (IPs) type, an hourly refresh, and the Cybora feed URL with the key redacted.

OPNsense dialog for configuring a Cybora IPv4 feed as a URL Tables IPs alias

Add a domain feed through Unbound DNS

  1. Go to Services > Unbound DNS > Blocklists.
  2. Enable the blocklist function and add the Cybora feed URL with type=domain to URLs of Blocklists.
  3. Save and apply the configuration.
  4. Add the Update Unbound DNSBLs task under System > Settings > Cron so OPNsense refreshes the list automatically. Choose an interval that doesn’t query the feed more often than your Cybora plan permits.
  5. Make sure protected clients use OPNsense Unbound DNS as their resolver. Requests sent directly to an external DNS resolver can bypass this domain blocking.

The Cybora domain feed is plain text with one domain per line. OPNsense ignores its comment lines beginning with #. A domain feed blocks DNS resolution of the listed domains; it can’t distinguish individual URL paths on the same domain.

Apply the alias in policy

  1. Open the firewall rule where you want to block or match the imported indicators.
  2. Use the Cybora alias as the source or destination, depending on your policy design.
  3. Set the action to block, reject, or another action appropriate for your policy model.
  4. Enable logging on the rule so you can confirm matches in live traffic.
  5. Apply the updated firewall configuration.

Validation

  1. Go to Firewall > Diagnostics > Aliases and inspect the loaded alias contents.
  2. Confirm that Last updated changes after the alias refreshes.
  3. Use Find references or the live firewall logs to verify that the alias is being matched by the intended rules.
  4. Test with known matching traffic and confirm that the rule behaves as expected.

Further reading