Security Lists

Security Lists are named, reusable collections of entries that replace single-entry access control lists. Instead of embedding individual IPs, ASNs, country codes, or TLS fingerprints directly in a rule, you group them into a list and reference the list by name. Security Lists are consumed by Security Rules and Risk Scoring, keeping your policies compact, readable, and easy to maintain.

Overview

A Security List is a named container for one of four entry types. Each list holds a single type of value, so you create separate lists for networks, ASNs, GeoIP countries, and JA4 fingerprints as needed. Once a list exists, it can be referenced by any number of Security Rules or Risk Scoring policies.

List Types

Network Lists

Network lists hold individual IPv4 or IPv6 addresses and CIDR ranges. Every entry is parsed and canonicalized using the Python ipaddress module.

Accepted formats:

• Single IP: 203.0.113.5, 2001:db8::1
• CIDR range: 203.0.113.0/24, 2001:db8::/32

ASN Lists

ASN lists hold Autonomous System Numbers. Entries may be written with or without the AS prefix; coreX Manager normalizes them to AS<n> on save.

• Accepted: AS12345, 12345
• Normalized to: AS12345
• Valid range: 1–4294967295

GeoIP Lists

GeoIP lists hold ISO 3166-1 alpha-2 country codes (two uppercase letters). Validation depends on whether a MaxMind Country database is available:

• MaxMind Country DB present: the country code must exist in the loaded database.
• No Country DB present: format-only validation (two letters, A–Z).

JA4 Lists

JA4 lists hold JA4 TLS client fingerprint strings. The JA4 format is:

{proto}{version}{sni}{cipher_count}{ext_count}{alpn}_{cipher_hash}_{ext_hash}

Example: t13d1516h2_8daaf6152771_b186095e22b6

Entries are validated against the JA4 regex pattern and normalized to lowercase on save.

Managing Lists

The Security Lists page organizes lists by type into tabs: Network, ASN, GeoIP, and JA4. Each tab shows the lists of that type with their entry counts and feed status.

Create a List

1. Navigate to Security > Security Lists
2. Select the tab for the list type you want (e.g. Network)
3. Click Add List
4. Enter a unique name (e.g. blocked-networks)
5. Optionally paste initial entries, one per line
6. Click Save

Delete a List

1. On the relevant tab, click Delete on the list row
2. Confirm the deletion

Dynamic Feeds

A dynamic feed lets a list refresh its entries automatically from a remote URL. This is ideal for threat intelligence, blocklists, and rotating fingerprint sets.

Configuring a Feed

Setting	Description
URL	Remote endpoint returning the feed text
Update interval	Refresh period in hours
Enabled	Toggle the feed on or off

Feed Parsing

The feed response is parsed one entry per line. Delimiter detection supports comma, semicolon, pipe, tab, and whitespace. Lines beginning with # are treated as comments and ignored. Blank lines are also ignored.

# Example threat feed
203.0.113.5,blocked
203.0.113.0/24
198.51.100.10 # inline comment

Supported Feed Types

Dynamic feeds support: network, asn, and ja4 lists. GeoIP lists cannot be populated by a dynamic feed (country codes are validated against the MaxMind database).

Manual Refresh

In addition to the scheduled interval, you can trigger an immediate refresh via the manual refresh button on the feed row.

HAProxy Generation

When configuration is applied, coreX Manager writes each Security List to a file:

data/lists/network/{name}.lst
data/lists/asn/{name}.lst
data/lists/geo/{name}.lst
data/lists/ja4/{name}.lst

Each file contains one value per line in canonical form. These files are ready for Security Rules to reference using HAProxy’s map_ip and -f file-loading mechanisms.

MaxMind GeoIP

coreX Manager includes a built-in GeoIpDownloader that maintains MaxMind GeoLite2 databases:

Database	Purpose
GeoLite2-Country	Country code validation; GeoIP fields in Security Rules
GeoLite2-City	City-level GeoIP fields in Security Rules
GeoLite2-ASN	ASN enrichment and validation

The downloader refreshes all three databases every 24 hours automatically.

Step-by-Step Examples

Example 1: Block a Known-Bad Network Range

1. Navigate to Security > Security Lists and select the Network tab
2. Click Add List, name it blocked-networks
3. Paste entries:

   203.0.113.0/24
   198.51.100.0/24

4. Click Save
5. Reference blocked-networks from a Security Rule with a deny action

Example 2: Score Traffic by ASN

1. Select the ASN tab and click Add List
2. Name it high-risk-asns
3. Paste entries:

   AS64500
   AS64501
   64502

4. Click Save — 64502 is normalized to AS64502
5. Reference high-risk-asns from a Risk Scoring rule

Example 3: Subscribe to a Dynamic Threat Feed

1. Select the Network tab and click Add List
2. Name it threat-feed-networks
3. Save the empty list
4. Open the list and enable the Dynamic Feed
5. Set the URL to your feed endpoint
6. Set the Update interval to 6 hours
7. Click Save, then Refresh now to pull immediately

Verification

1. Check the list file — after an apply, confirm the file exists:

   cat data/lists/network/blocked-networks.lst

2. Check entry counts — the Security Lists page shows the entry count for each list
3. Preview the config — on the Dashboard, click Preview and confirm the generated HAProxy config references your list files
4. Test a rule — send test traffic that should match a list entry and confirm the rule action fires

Next Steps

• Security Rules — Reference Security Lists in ordered rules with the coreX expression language
• Risk Scoring — Score traffic using lists and other signals
• WAF — Layer Coraza WAF rules on top of your Security Lists