Country IP lists — firewall usage guide

URL pattern for any country (lowercase ISO code):

Test on a non-production policy first. A wrong match can lock you out.

Easiest path: import the ready ir_ipv4_list.rsc file. It creates address-list iran_ipv4.

For a daily refresh, import the helper script once:

/tool fetch url="https://mirror.rasanegaar.com/info/scripts/mikrotik-refresh.rsc" dst-path=mikrotik-refresh.rsc
/import file-name=mikrotik-refresh.rsc

Then reference the list in firewall rules, for example:

/ip firewall filter
add chain=forward action=accept src-address-list=ir_ipv4 comment="Iran IPv4 — RASANEGAAR.com"

Both support URL-based aliases that refresh on a timer.

OPNsense: Firewall → Aliases → Add → Type URL Table (IPs). Set Content/URL to:

Name it e.g. IRAN_IPV4, refresh daily (or every few hours), then use the alias in firewall rules.

pfSense: Firewall → Aliases → Add → Type URL (IPs) or URL Table (IPs) (depends on version), same URL, Apply Changes.

Allow the firewall itself outbound HTTPS to mirror.rasanegaar.com:443 so the alias can update.

Preferred approach: an external address resource that pulls the TXT on a schedule.

config system external-resource
    edit "IRAN_IPV4"
        set type address
        set resource "https://mirror.rasanegaar.com/info/countries/IR/ir_ipv4_list.txt"
        set refresh-rate 1440
        set status enable
    next
end

From the GUI: Security Fabric → External Connectors → create an IP Address / threat-feed style connector (labels vary by FortiOS) and paste the same URL. Then use IRAN_IPV4 as source or destination in policies.

FortiWeb usually consumes IP lists as an IP List object, or you enforce geography upstream on FortiGate.

1) Import an IP List: download the TXT and import under Web Protection / IP Protection → IP List (menu names differ by version).

curl -fsSL https://mirror.rasanegaar.com/info/countries/IR/ir_ipv4_list.txt -o ir_ipv4_list.txt

2) Pair with FortiGate: keep the external resource on FortiGate for L3/L4 policy and use FortiWeb for HTTP-layer controls.

For automated refresh on FortiWeb itself, cron the download on a management host and push via API/CLI.

Classic ASA / IOS has no built-in URL IP table like pfSense. Build an object-group network instead. This script converts our TXT into ASA commands:

curl -fsSL https://mirror.rasanegaar.com/info/scripts/cisco-asa-object-group.sh -o cisco-asa-object-group.sh
chmod +x cisco-asa-object-group.sh
./cisco-asa-object-group.sh \
  https://mirror.rasanegaar.com/info/countries/IR/ir_ipv4_list.txt \
  IRAN_IPV4 > iran_ipv4_asa.txt

Paste the output in config mode (or push with your automation). Re-run regularly from cron on a jump host to refresh.

Firepower / FTD (FMC): create network objects under Objects → Object Management, or attach a custom Security Intelligence / feed URL when your license and version allow it. Otherwise push the generated object-group via automation.

When a platform does not accept a raw CIDR URL, use the pre-built syntax files below. The full list is on the status page and /info/ listing.

Helper files for loading the list on the platforms above: