EDL List Sources: Where to Get an External Dynamic List URL

An External Dynamic List is just a plain-text file of IP addresses and CIDR blocks served over HTTPS, one per line, that your firewall re-fetches on a schedule. If you need a URL to test with right now, use the free sample below. If you need something curated for VPN brute force that fits inside every firewall's capacity limit, that is what ThreatListPro publishes. Every other source in the table below is free, real, and worth knowing about.

A Free EDL URL You Can Use Right Now

No signup, no API key, no credit card. Copy this URL into your firewall's external list configuration and it will start pulling 200 curated VPN brute force IPs immediately:

That sample exists so you can prove the plumbing works before spending anything. Configure it, confirm your firewall reports the entry count it expects, and then decide whether you need the full list. Our setup instructions cover the exact steps for each platform.

EDL Sources Compared

Entry counts below were fetched live on September 16, 2026. They move day to day, but the orders of magnitude are stable and they are what decides whether a list fits your firewall.

What Makes a Valid EDL File

Most "my EDL loaded zero entries" tickets come down to format. A file that works everywhere looks like this:

# Comments start with a hash and are ignored
203.0.113.0/24
198.51.100.17
192.0.2.0/25

• Plain text only. Served as text/plain. JSON, CSV and HTML-wrapped pages are rejected or parsed into nonsense.
• One entry per line. A bare IPv4 or IPv6 address, or a CIDR block. No ports, no comments trailing on the same line as an entry.
• HTTPS with a trusted certificate. The firewall has to validate the chain. A self-signed cert means a silent fetch failure and a stale list.
• Stable URL. Redirects sometimes work and sometimes do not, depending on platform. Point the firewall at the final URL.
• Correct list type. An IP list configured as a Domain list parses every line, rejects all of them, and reports a healthy connector holding nothing.

Hosted EDL vs Running Your Own

You can publish an EDL yourself from any web server. The question is whether you want to own the two jobs that come with it.

Curation is the harder one. An IP list is only useful if something removes stale entries as attacker infrastructure rotates and adds new ones as it appears. A list nobody maintains becomes a false-positive generator within weeks, and false positives on a VPN gateway mean locked-out staff.

Availability is the quieter one. If the firewall cannot fetch the file it keeps serving the last copy it got, usually without alerting anyone. Your blocklist silently freezes on the day your web server went down.

Self-hosting is the right answer when you need to publish an internal list that must not leave your network, or when you are aggregating your own detections. For public attacker infrastructure, a maintained feed is almost always cheaper than the hours you would spend keeping one current.

Adding an EDL URL to Your Firewall

The concept is identical on every platform; only the menu names change. Step-by-step guides:

Which List Should You Actually Use?

A reasonable default for a firewall protecting a VPN portal is two lists, not one:

• One curated list for the surface under attack. For SSL-VPN and GlobalProtect portals that means a VPN-specific brute force list, which is the gap ThreatListPro exists to fill. General-purpose aggregates spend most of their capacity on spam relays and web scanners that will never touch your VPN.
• One hygiene list. Spamhaus DROP is small, precise, and safe to block outright. It costs about 1,700 entries and removes a class of traffic you never want.

Add a third only if your platform has capacity to spare. Our 2026 blocklist stack walks through the layering in more detail, and ThreatListPro vs FireHOL covers the curated-versus-aggregated tradeoff directly.