EN DE

IP blocklists for firewalls, scored in real time.

Your firewalls, IDS, honeypots and AAA servers report threats to NxtFireGuard. Every IP gets a score from your data, the community and third-party threat intelligence. When an IP crosses your threshold, it goes on your blocklist and your firewalls enforce the block.

Get started free Documentation

Why static blocklists go stale.

Firewall blocklists kept by hand or exported once go out of date fast.

  • The list is out of date right away.

    It shows how things looked the day it was exported. Then attackers move to new addresses, hacked systems get cleaned up and new ones show up. The list notices none of it.

  • Nobody can keep up by hand.

    Removing entries by hand takes more time than anyone has. If you stop, you end up blocking addresses that have been clean for ages. And the ones attacking you right now get through.

  • Third-party feeds do not know your network.

    Without checks, thresholds and a whitelist, one wrong entry is enough to block traffic you need.

How NxtFireGuard works.

The path of an IP address through NxtFireGuard Sensors report attacking IP addresses. Every IP is scored against community and third-party threat intelligence. Traffic sensors check live connections locally and put IPs over the threshold on the blocklist. Firewalls pull the blocklist over HTTPS. Blocked IPs are re-evaluated all the time and removed once they are clean. Threat intelligence community and third party 01 Sensors firewall, IDS, honeypot, AAA server 02 Scoring every IP is scored 04 Blocklist pulled over HTTPS HTTPS Firewalls 03 Traffic sensors live connections, checked locally 05 Automatic Re-Evaluation clean, removed The path of an IP address through NxtFireGuard Sensors report attacking IP addresses. Every IP is scored against community and third-party threat intelligence. Traffic sensors check live connections locally and put IPs over the threshold on the blocklist. Firewalls pull the blocklist over HTTPS. Blocked IPs are re-evaluated all the time and removed once they are clean. 01 Sensors firewall, IDS, honeypot, AAA Threat intelligence community and third party 02 Scoring every IP is scored 03 Traffic sensors live connections, local 04 Blocklist pulled over HTTPS HTTPS Firewalls 05 Automatic Re-Evaluation

  1. Your network

    Sensors report

    Firewalls, IDS, honeypots and AAA servers send their threat logs to NxtFireGuard. You keep the devices you already run.

  2. NxtFireGuard

    Every IP gets a score

    Each reported IP address is checked against community intelligence and third-party threat intelligence.

  3. Your network

    Traffic gets checked

    A traffic sensor checks live connections against scores it keeps locally. When an IP goes over your threshold, it goes on your blocklist.

  4. Your network

    Firewalls block

    Your firewalls pull the blocklist over HTTPS. As an External Dynamic List or as a plain IP list.

  5. NxtFireGuard

    Re-evaluated, all the time

    Blocked addresses get scored again and again. Once an IP is clean, it comes off the list. Nobody has to touch it.

What is included.

  • Multi-source Threat Collection

    Connect the firewalls, honeypots and AAA servers you already have. Nothing gets replaced, and every source feeds the same scoring.

  • Live Traffic Analysis

    Traffic sensors watch connections as they happen. They check source and destination addresses against a local threat database.

  • Community Intelligence

    All users share one threat pool. What one network reports protects everyone else running NxtFireGuard.

  • Automatic Re-Evaluation

    Blocked IPs get scored again on a schedule and clean ones drop off by themselves. The blocklist does not grow forever.

  • Whitelist & Threshold Control

    You decide per blocklist when an IP gets blocked, separately for private and public addresses. IPs on the whitelist are never blocked.

  • Complete Audit Trail

    Threat events, blocks and changes are logged and searchable. For every block you can see why it is there.

Specifications.

ComponentIntegrationNote
Cisco FTD (Firepower) Syslog through a Threat Feed AggregatorWorks with FMC-managed setups with several devices too
Cisco ISE Syslog through a Threat Feed AggregatorOne sensor per ISE node
OPNsense Suricata IDS alerts over syslog through a Threat Feed AggregatorEvery IDS alert becomes a report
Palo Alto Networks NGFW Threat logs over HTTPS using an HTTP server profile and a log forwarding profileBlocklist as an External Dynamic List
T-Pot honeypots Honeypot hits through a Logstash Threat Feed AggregatorEvery hit is a reported attacker
Other sources Generic JSON endpointYour own systems report over HTTP POST
Traffic sensor Syslog or port mirroringKeeps scores locally and decides on blocks inside your network
Blocklist retrieval HTTPSFirewalls that poll external IP lists, such as Palo Alto (EDL) or pfSense

Guides for every integration are in the NxtFireGuard documentation. The IP Lookup shows whether an address is known.

The dashboard.

dashboard.nxtfireguard.nxtgenit.de
NxtFireGuard dashboard. The overview with IP actions, traffic and threat events, and charts of blocklist changes and traffic events over time. NxtFireGuard dashboard. The overview with IP actions, traffic and threat events, and charts of blocklist changes and traffic events over time.
The overview with IP actions, traffic and threat events, and blocklist changes over time.
dashboard.nxtfireguard.nxtgenit.de
NxtFireGuard dashboard. Threat events over time and a table of reported addresses with Source-IP, NFG score, country and the honeypot or IDS that reported them. NxtFireGuard dashboard. Threat events over time and a table of reported addresses with Source-IP, NFG score, country and the honeypot or IDS that reported them.
This is where the data comes in. Threat events with Source-IP, NFG score, country and reporting source.
dashboard.nxtfireguard.nxtgenit.de
NxtFireGuard dashboard. Blocklist changes over time and a table of blocks and unblocks, triggered by re-evaluation or a traffic sensor. NxtFireGuard dashboard. Blocklist changes over time and a table of blocks and unblocks, triggered by re-evaluation or a traffic sensor.
This is where addresses leave the list again. Blocks and unblocks, triggered by Automatic Re-Evaluation or a traffic sensor.

Your first blocklist.

  1. Connect your threat sensors

    Point firewalls, honeypots or AAA servers at NxtFireGuard. There are guides for Cisco Firepower, Palo Alto NGFW, T-Pot, Cisco ISE and OPNsense. Anything else can report through the JSON endpoint.

  2. Deploy a traffic sensor

    A small sensor reads live traffic over syslog or port mirroring. It keeps the scores locally, so block decisions happen inside your network.

  3. Set up your blocklist

    Set thresholds, attach traffic sensors, keep the whitelist up to date. Private and public addresses get their own thresholds. You choose how often addresses are re-evaluated.

  4. Point your firewalls at it

    Your firewalls poll the blocklist from its URL and enforce the blocks.

Start free.

The Basic tier is free and you do not need a credit card. Starter, Standard and Enterprise give you more sensors, blocklists, users and support.

Prices, limits and SLA details are only on nxtfireguard.de. We do not repeat them here, so they only need updating in one place.

Plans on nxtfireguard.de

Questions and answers.

What is an IP blocklist for firewalls?

A list of IP addresses that a firewall pulls on a regular basis. Connections from those addresses get dropped right away, before any rule has to look at them. Firewalls read these lists over HTTPS. Palo Alto calls them External Dynamic Lists and Cisco calls them Security Intelligence feeds. With NxtFireGuard, entries are based on your own sensors, the community and third-party threat intelligence. Blocked addresses are scored again on a schedule.

Why do static blocklists go stale?

A static list shows how things looked on the day it was exported. After that, attackers move to new addresses, hacked systems get cleaned up and new ones show up. Without regular re-evaluation the list ends up blocking addresses that have been clean for ages. And the ones attacking you today get through. NxtFireGuard scores every address again and again and takes clean ones off automatically.

Which firewalls can use the blocklist?

Firewalls that can poll an external IP list, for example Palo Alto Networks as an External Dynamic List, or pfSense. Cisco FTD, Cisco ISE, OPNsense, Palo Alto Networks NGFW and T-Pot are documented as sources of threat logs.

Where does the threat data come from?

From three places. The logs of your own firewalls, IDS, honeypots and AAA servers. The community of everyone using NxtFireGuard. And third-party threat intelligence. Every IP is scored against all three.

How does NxtFireGuard avoid blocking legitimate addresses?

There are three safeguards. You set a threshold per blocklist. Addresses on your whitelist are never blocked. And regular re-evaluation takes clean addresses off again. The audit trail shows how each block came about.

What is a traffic sensor, and do I need one?

A small service in your network. It reads live connections over syslog or port mirroring and checks them against scores it keeps locally. That way the decision is made where the traffic is. You do not need one just to report. You do need one for live checks and automatic block requests.

Is there a free version of NxtFireGuard?

Yes. The Basic tier is free and you do not need a credit card. Starter, Standard and Enterprise give you more sensors, blocklists, users and support. Prices and SLA details are only on nxtfireguard.de/pricing.

Who develops and operates NxtFireGuard?

NxtGenIT in Ulm, Germany. The same people build it and run it. The documentation is at docs.nxtfireguard.de and you can reach support from inside the product.

Start free with Basic.

Connect a sensor and let your firewall pull the blocklist. The documentation walks you through every integration.

Get started free Documentation nxtfireguard.de

To find out what the internet can reach at your organization, Tyvar runs an external penetration test (tyvar.de).