Connect Q-Feeds to OPNsense

What the plugin provides

• Malware IP: dangerous IP addresses as firewall aliases
• Malware domains: malicious domains for Unbound DNS blocking (when enabled)

Step 1: Install the Q-Feeds plugin

1. Go to System > Firmware > Plugins.
2. Search for the Q-Feeds plugin and select the + icon to install it.

Step 2: Raise maximum table size (older versions)

On some older OPNsense builds you need at least 2,000,000 firewall table entries:

1. Go to Firewall > Settings > Advanced.
2. Set Firewall Maximum Table Entries to at least 2000000 (empty means the default, which may be too low).
3. Confirm usage under Firewall > Aliases (counter in the top right).

Step 3: Activate the plugin

1. Go to Security > Q-Feeds Connect.
2. Paste the API token from Manage API Keys in the Threat Intelligence Portal (tip.qfeeds.com).
3. Select Apply. The plugin fetches intelligence and creates firewall aliases.

Step 4: Create firewall rules for IP blocking

Go to Firewall > Rules. Use an interface rule or a Floating rule to cover multiple interfaces. A typical setup uses two Floating rules:

Outbound (clients must not reach malicious IPs)

1. Select Floating, then create a new rule.
2. Action: Block (or Reject on LAN if you prefer an explicit reject).
3. Interface: for example LAN (and others as needed).
4. TCP/IP Version: IPv4+IPv6 if you use both (feeds include both).
5. Direction: typically in.
6. Enable Logging so the plugin Events page can show blocks.
7. Destination: the Malware IPs alias created by the plugin.

Inbound (optional)

1. Create a second Floating rule with the Malware IPs alias as Source on WAN (or relevant interfaces).
2. This blocks traffic originating from known-bad addresses. Often optional if inbound is already tightly allow-listed.

DNS / domain blocking with Unbound

Unbound must be your primary DNS resolver for domain-based blocking. See the OPNsense Unbound documentation.

1. In Security > Q-Feeds Connect, enable Register domain feeds.
2. On older versions (< 25.7.9): go to Services > Unbound DNS > General and enable Unbound if needed, then Services > Unbound DNS > Blocklist and enable blocklists (you can keep other lists such as ads).
3. Confirm population under Reporting > Unbound DNS (details tab shows requests and blocks).

Plus or Premium license

1. Purchase Plus or Premium from the OPNsense product page / webstore. Use the same email as your portal account so the license attaches automatically.
2. If you receive an activation key, activate it under your account Licenses > Activate new license, then assign it to your API key under API Key management.

Download the PDF manual