Update OPNsense to a current firmware (this guide was written against 25.7.x). Obtain your API key from the portal. See Get your threat feeds. Update intervals follow your license: Community every 7 days, Plus every 4 hours, Premium every 20 minutes.
What the plugin provides
- Malware IP: dangerous IP addresses as firewall aliases
- Malware domains: malicious domains for Unbound DNS blocking (when enabled)
Step 1: Install the Q-Feeds plugin
- Go to System > Firmware > Plugins.
- Search for the Q-Feeds plugin and select the + icon to install it.
Step 2: Raise maximum table size (older versions)
On some older OPNsense builds you need at least 2,000,000 firewall table entries:
- Go to Firewall > Settings > Advanced.
- Set Firewall Maximum Table Entries to at least
2000000(empty means the default, which may be too low). - Confirm usage under Firewall > Aliases (counter in the top right).
Step 3: Activate the plugin
- Go to Security > Q-Feeds Connect.
- Paste the API token from Manage API Keys in the Threat Intelligence Portal (tip.qfeeds.com).
- Select Apply. The plugin fetches intelligence and creates firewall aliases.
Step 4: Create firewall rules for IP blocking
Go to Firewall > Rules. Use an interface rule or a Floating rule to cover multiple interfaces. A typical setup uses two Floating rules:
Outbound (clients must not reach malicious IPs)
- Select Floating, then create a new rule.
- Action: Block (or Reject on LAN if you prefer an explicit reject).
- Interface: for example LAN (and others as needed).
- TCP/IP Version: IPv4+IPv6 if you use both (feeds include both).
- Direction: typically in.
- Enable Logging so the plugin Events page can show blocks.
- Destination: the Malware IPs alias created by the plugin.
Inbound (optional)
- Create a second Floating rule with the Malware IPs alias as Source on WAN (or relevant interfaces).
- This blocks traffic originating from known-bad addresses. Often optional if inbound is already tightly allow-listed.
IPv6 addresses rotate quickly; IPv6 blocking is a smaller part of the intelligence set. Add IPv6 rules if your network uses IPv6.
DNS / domain blocking with Unbound
Unbound must be your primary DNS resolver for domain-based blocking. See the OPNsense Unbound documentation.
- In Security > Q-Feeds Connect, enable Register domain feeds.
- On older versions (< 25.7.9): go to Services > Unbound DNS > General and enable Unbound if needed, then Services > Unbound DNS > Blocklist and enable blocklists (you can keep other lists such as ads).
- Confirm population under Reporting > Unbound DNS (details tab shows requests and blocks).
Plus or Premium license
- Purchase Plus or Premium from the OPNsense product page / webstore. Use the same email as your portal account so the license attaches automatically.
- If you receive an activation key, activate it under your account Licenses > Activate new license, then assign it to your API key under API Key management.