# Suricata and IP blacklist **URL:** \ **Category:** Help\ **Created:** [January 13, 2021, 8:25pm UTC](https://forum.suricata.io/t/suricata-and-ip-blacklist/972 "2021-01-13T20:25:43Z")\ **Posts on this page:** 6\ **Page:** 4
**Author:** ![ManuelFFF](https://avatars.discourse-cdn.com/v4/letter/m/a88e4f/32.png) [@ManuelFFF](https://forum.suricata.io/u/ManuelFFF)\ **Post date:** [February 15, 2021, 2:57pm UTC](https://forum.suricata.io/t/suricata-and-ip-blacklist/972/61 "2021-02-15T14:57:08Z")
Hi @vjulien , Thank you for continue researching this issue. I will try filtering the IP lists and share feedback later. Quick question. I am using `scirius-iprep.list` plus a custom black list as well, as described [here](https://forum.suricata.io/t/suricata-and-ip-blacklist/972/33). Per your recommendation, I am assuming that I need to split both lists, right? Also as a side report: Even after I defined a custom path for all the iprep files, and I moved `scirius-iprep.list` to the new location, the same file it’s being created automatically in the old path. Current config can be found in the link provided. Old path: `/etc/suricata/rules/` New path: `/etc/suricata/rules/iprep/` I am not sure if Suricata is reading the `scirius-iprep.list` stored in the new path, as the most recent date belongs to the file in the old path, so I will split both for now, unless you advice something else. Thanks ---
**Author:** ![ManuelFFF](https://avatars.discourse-cdn.com/v4/letter/m/a88e4f/32.png) [@ManuelFFF](https://forum.suricata.io/u/ManuelFFF)\ **Post date:** [February 15, 2021, 8:49pm UTC](https://forum.suricata.io/t/suricata-and-ip-blacklist/972/62 "2021-02-15T20:49:30Z")
Hi, I am happy to announce that the solution provided by @vjulien seems to be working fine 😁 πŸ‘ πŸŽ‰!! I created separate lists for IPv4 and IPv6. The tests carried out so far shows that Suricata successfully blocks access to up to 36,000 items. Comments: - I splitted my custom blacklist `test-iprep.list` into IPv4 and IPv6 and with that done, Suricata is reading and blocking test IP address in position 36000 within the list. - I did not apply the same solution to `scirius-iprep.list` and yet the issue seems to be resolved. I can confirm that `scirius-iprep.list` has both IPv4 and IPv6 addresses. - Is the issue related only to my custom list? ---
**Author:** ![vjulien](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/vjulien/32/4_2.png) [@vjulien](https://forum.suricata.io/u/vjulien)\ **Post date:** [February 15, 2021, 9:10pm UTC](https://forum.suricata.io/t/suricata-and-ip-blacklist/972/63 "2021-02-15T21:10:08Z")
If the list has all the IPv6 addresses after the IPv4 addresses, then it should also work. ---
**Author:** ![ManuelFFF](https://avatars.discourse-cdn.com/v4/letter/m/a88e4f/32.png) [@ManuelFFF](https://forum.suricata.io/u/ManuelFFF)\ **Post date:** [February 15, 2021, 9:25pm UTC](https://forum.suricata.io/t/suricata-and-ip-blacklist/972/64 "2021-02-15T21:25:52Z")
IPv4 and IPv6 are mixed within `scirius-iprep.list` ---
**Author:** ![ManuelFFF](https://avatars.discourse-cdn.com/v4/letter/m/a88e4f/32.png) [@ManuelFFF](https://forum.suricata.io/u/ManuelFFF)\ **Post date:** [February 16, 2021, 2:44pm UTC](https://forum.suricata.io/t/suricata-and-ip-blacklist/972/65 "2021-02-16T14:44:08Z")
Hi, I want to thank you all for attending and focusing on my problem and for providing a solution that works in such a short time. For now I will be using the workaround, which consist on separate IPv4 and IPv6 addresses for the blacklists. Soon I will apply the latest Suricata updates and that should be the final solution. Before closing this thread, I have another question. Does Suricata actually has an engine similar to IPREP, but designed for domains instead of IPs? Something like DNSREP πŸ˜‹. The goal would be to have IPs blacklists and domains blacklists, to massively block access, instead of creating separate rules for each domain, like some examples I have seen for sites like Facebook. Thank you in advance ---
**Author:** ![ManuelFFF](https://avatars.discourse-cdn.com/v4/letter/m/a88e4f/32.png) [@ManuelFFF](https://forum.suricata.io/u/ManuelFFF)\ **Post date:** [February 16, 2021, 8:36pm UTC](https://forum.suricata.io/t/suricata-and-ip-blacklist/972/66 "2021-02-16T20:36:33Z")
I got the response from @pevma . It looks like DATAREP should be option to block domains given a blacklist. I will start testing this engine really soon, now that IPREP is working fine. Last test was successfully completed with more than 70200 items in a blacklist. Thanks to all you guys!! Great team! [Previous page](https://forum.suricata.io/t/suricata-and-ip-blacklist/972.md?page=3)