pfBlockerNG Recommended Feeds for 2026: IP and DNSBL Lists That Still Work

The best pfBlockerNG feeds in 2026 are the ones that are still maintained: Spamhaus DROP, ET_Block, ISC_Block and CINS_army for IP blocking, and StevenBlack or HaGeZi for ads plus URLhaus, ThreatFox and OpenPhish for malware and phishing in DNSBL. Several feeds that older guides (including the first version of this one) recommend have stopped updating, and HaGeZi moved its pfBlockerNG-compatible lists to a new repository on August 1, 2026, so it is worth checking your setup now.

I checked every feed below on 18 October 2026 by downloading it and reading its last-updated header or Last-Modified date. pfBlockerNG versions referenced are pfBlockerNG-devel 3.2.16 on pfSense CE 2.9 / pfSense Plus 26.07.

If you want to learn pfSense end to end, here is my complete pfSense course.

Quick answer: a sensible 2026 starter set

IPv4 (Firewall > pfBlockerNG > IP > IPv4):

1. Spamhaus_Drop (Spamhaus DROP; EDROP was merged into DROP in 2024)
2. ET_Block (Emerging Threats)
3. ISC_Block (SANS Internet Storm Center)
4. CINS_army (CINS Score)
5. BlockListDE_All (inbound only, for exposed services)

DNSBL (Firewall > pfBlockerNG > DNSBL > DNSBL Groups):

1. Ads and trackers: StevenBlack_ADs, or HaGeZi Multi/Pro from the legacy repo
2. Malware: abuse.ch URLhaus and ThreatFox
3. Phishing: OpenPhish
4. Optional: NoCoin (cryptominers), HaGeZi DoH list if you want to stop DNS bypass

Feed status check (October 2026)

IP feeds

DNSBL feeds

A frozen feed is not harmful by itself, but it gives you a false sense of coverage and old entries are more likely to be false positives. Check your own feeds in Firewall > pfBlockerNG > Update after a Force Update: any feed that fails to download is logged there.

The HaGeZi change you must act on

HaGeZi announced in June 2026 that from August 1, 2026 the subdomain (domains) and hosts formats are no longer served from the main hagezi/dns-blocklists repository; the old GitHub RAW and jsDelivr links stopped working. The lists still exist, updated daily, in hagezi/dns-blocklists-legacy, and pfBlockerNG is listed there as a supported tool.

If your DNSBL group has a HaGeZi URL, replace it with the legacy one. The useful files for pfBlockerNG:

https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists-legacy@latest/domains/light.txt
https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists-legacy@latest/domains/multi.txt
https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists-legacy@latest/domains/pro.txt
https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists-legacy@latest/domains/tif.txt
https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists-legacy@latest/domains/doh.txt

Pick one of Light, Multi or Pro (Multi is a good default; Pro is stricter). tif.txt (threat intelligence) is large, around 35 MB, so only add it on a firewall with plenty of RAM. HaGeZi notes that the subdomain format cannot catch unknown subdomains, so these lists are less complete than the adblock-style versions; the pfBlockerNG developer has said on the Netgate forum that adblock-style feed support is being worked on.

How to add a feed in pfBlockerNG-devel

1. Install the package: System > Package Manager > Available Packages, search pfBlockerNG-devel, Install. On a fresh install, the Wizard sets up a basic IP and DNSBL configuration for you.
2. Go to Firewall > pfBlockerNG > DNSBL > DNSBL Groups and click Add.
3. Name the group (for example Ads), then under DNSBL Source Definitions add one row per feed:
   • Format: Auto
   • State: ON
   • Source: the feed URL
   • Header/Label: a short name such as HaGeZi_Multi
4. Set Action to Unbound and Update Frequency to Once a day.
5. Save, then Firewall > pfBlockerNG > Update, choose Force and Update, and watch the log for errors.

For built-in feeds, the Feeds tab lists every feed pfBlockerNG knows about with a + button to add it to a group, which saves typing URLs. IP feeds work the same way under IP > IPv4. A common choice is Deny Inbound for inbound and Reject for outbound, so internal users get an immediate error instead of a timeout.

Recommended DNSBL settings

In Firewall > pfBlockerNG > DNSBL:

• DNSBL Mode: Unbound python mode. It uses less memory than the old Unbound mode, reloads faster and supports wildcard (TLD) blocking and the whitelist properly.
• Wildcard Blocking (TLD): on, so a listed domain also blocks its subdomains.
• DNSBL Webserver / VIP: leave the default 10.10.10.1 unless it clashes with your network.
• DNSBL SafeSearch > DoH/DoT/DoQ Blocking: enable and select the public DoH providers, so browsers and apps cannot skip your DNS.

You need the DNS Resolver (Unbound) enabled under Services > DNS Resolver. DNSBL does not work with the DNS Forwarder (dnsmasq). If you are weighing the two on OPNsense, see Dnsmasq vs Unbound.

pfBlockerNG not blocking ads? Work through this

1. Test from a client. On Windows, macOS or Linux:

nslookup doubleclick.net

If the answer is 10.10.10.1 (your DNSBL VIP), DNSBL works and the problem is elsewhere. If you get a real Google IP, the client did not ask pfSense, or the domain is not on your lists.

2. Make sure clients use pfSense for DNS. Under Services > DHCP Server, the DNS servers should be empty (which hands out the pfSense LAN IP) or set to the LAN IP. Static devices and some smart TVs use hard-coded DNS such as 8.8.8.8, so add a NAT redirect: Firewall > NAT > Port Forward, interface LAN, protocol TCP/UDP, destination ! LAN address, port 53, redirect target 127.0.0.1 port 53.

3. Stop browser DNS over HTTPS. Chrome, Edge and Firefox can use their own encrypted DNS and bypass pfBlockerNG entirely. Turn on DoH/DoT/DoQ blocking (above), add the HaGeZi doh.txt list, block outbound TCP/UDP 853 (DNS over TLS), or switch Secure DNS off by policy on managed machines.

4. Force an update and check Unbound reloaded. Firewall > pfBlockerNG > Update > Force > Update. In the log, look for Reloading Unbound... completed. If it says "Not completed", Unbound failed to load the lists: remove the largest feed and try again.

5. Flush caches. On the client: ipconfig /flushdns (Windows) or sudo resolvectl flush-caches (Linux), then restart the browser. Phones keep a cache too; toggling flight mode clears it.

6. Check the domain is actually listed. Firewall > pfBlockerNG > Reports > Alerts shows DNSBL hits. If an ad still shows, find its domain in the browser's developer tools (Network tab) and search for it in Reports > Alerts or add it to a custom DNSBL list.

7. Accept the limits. DNS blocking only works when ads come from separate ad domains. YouTube, Facebook and Instagram ads are served from the same domains as the content, so no DNS blocker (pfBlockerNG, Pi-hole or AdGuard Home) can remove them without breaking the site. Use a browser extension such as uBlock Origin for those.

8. Hardware limits. On 1 GB appliances, huge lists can stop Unbound from starting, which shows up as "no internet". Stick to one ad list and the abuse.ch lists.

pfBlockerNG vs pfBlockerNG-devel

Both packages are still in the pfSense repository. New code goes to pfBlockerNG-devel first and moves to pfBlockerNG after testing. In the pfSense ports tree today, -devel is at 3.2.16 and the stable package at 3.2.15. Use -devel; it is what the developer and most forum answers assume. Do not install both at once.

IP feeds: inbound vs outbound

• Inbound only: BlockListDE_All and CINS_army are lists of attacking hosts. They matter most if you publish services (VPN, web server). Blocking them outbound adds little.
• Both directions: Spamhaus_Drop, ET_Block and ISC_Block cover hijacked and criminal networks you should never talk to either way.
• GeoIP: blocking countries needs a free MaxMind licence key under IP > IP Configuration. Block inbound by country for exposed services; blocking whole countries outbound tends to break things.

Related guides

• pfSense: elevate your network security
• pfSense vs OPNsense in 2026
• Pi-hole DNS server installation, if you want DNS blocking outside the firewall
• Network access control with pfSense