BYTETOOLS

IP Blocklist Generator

Turn a list of IPs and CIDR ranges into nginx, Apache, iptables, ufw, netsh or plain CIDR rules, with duplicates removed and ranges merged.

0
Entries read
0
IPv4 blocks out
0
Blocks saved by merging
0
IPv4 addresses covered

nginx — deny rules

Paste some addresses above — or load the sample list — and the rules for your chosen firewall or web server appear here.

Everything runs in your browser: the list you paste is never uploaded, and no address is looked up. Always review generated firewall rules before applying them — an over-broad merge can lock you out of your own server.

What is the IP Blocklist Generator?

The IP Blocklist Generator takes a messy list of addresses — one per line, comma separated, with comments, duplicates and overlapping ranges — and produces clean, ready-to-paste firewall or web-server rules.

  • Eight output formats: nginx, Apache 2.4, legacy .htaccess, iptables, ufw, netsh, CIDR and CSV
  • Merges adjacent and contained ranges into the smallest exact CIDR set
  • De-duplicates, sorts numerically and strips inline # or ; comments
  • IPv6 entries are recognised and routed to ip6tables or the equivalent syntax
  • Table of every resulting block with its first address, last address and size
  • All 32-bit arithmetic runs locally — nothing is uploaded or looked up

How to use the IP Blocklist Generator

  1. 1

    Paste your addresses and CIDR ranges into the box — bare addresses are treated as /32 and anything after # or ; is ignored.

  2. 2

    Choose the output format for your web server or firewall.

  3. 3

    Leave range merging on for the shortest rule set, or turn it off to keep the blocks exactly as you wrote them.

  4. 4

    Check the summary tiles and the block table to see how many addresses you are actually blocking.

  5. 5

    Copy the rules or download them as a config file, then review before applying.

About the IP Blocklist Generator

The IP Blocklist Generator takes a messy list of addresses — one per line, comma separated, with comments, duplicates and overlapping ranges — and produces clean, ready-to-paste firewall or web-server rules. Pick nginx deny, Apache 2.4 Require not ip, legacy .htaccess, iptables and ip6tables, ufw, Windows netsh, a plain CIDR list or CSV.

Before generating anything it de-duplicates the entries, sorts them numerically and merges adjacent or contained ranges into the smallest exact set of CIDR blocks. Two /25s that sit next to each other become one /24; four consecutive addresses become a /30. The result is a shorter rule set that matches exactly the same addresses.

All of the arithmetic is 32-bit integer maths done in your browser. Nothing is uploaded, no address is looked up, and the generated rules are shown in full before you copy them — always review a blocklist before applying it, because an over-broad merge can lock you out of your own server.

Frequently asked questions

How do I block a range of IP addresses in nginx?

Use deny with a CIDR block inside a server or location context, for example deny 203.0.113.0/24; and finish with allow all;. Paste your list here, pick the nginx format, and the tool writes the whole block for you with duplicates merged.

What does merging adjacent CIDR ranges actually do?

It replaces several blocks with the single larger block that covers exactly the same addresses. 192.168.0.0/25 plus 192.168.0.128/25 becomes 192.168.0.0/24, and four consecutive /32s become one /30. Fewer rules means faster matching and a config you can read.

Will merging ever block more addresses than I listed?

No. Merging only combines blocks that are already adjacent or contained, so the resulting set covers exactly the same addresses — the summary shows the total so you can confirm it. It never rounds up to a bigger prefix to tidy the list.

Should I block IPs at the firewall or in the web server?

The firewall is cheaper because the packet is dropped before your application ever sees it, and it protects every service on the host. Web server rules are easier to change without root and can be scoped to a single site. Large lists belong in ipset or nftables rather than individual iptables rules.

Does this tool look up who owns the addresses?

No. It does pure arithmetic on the addresses you paste. WHOIS, ASN and geolocation all need a live query or a multi-megabyte database, neither of which is possible in a page that runs entirely offline.

Is my blocklist uploaded anywhere?

No. Parsing, merging and rule generation all happen in your browser. That matters, because a blocklist is often a list of addresses that have already attacked you and is not something to hand to a third party.

Related tools