Automatically block known VPN attackers on your SonicWall firewall with ThreatListPro's real-time IP blocklist. Protect SSL-VPN and Global VPN Client endpoints.
Start Blocking Attacks -- $9.99/moSonicWall SSL-VPN and Global VPN Client endpoints are heavily targeted by automated brute force bots. Recent CVEs have made SonicWall a top priority for attackers.
SonicWall firewalls are widely deployed in SMB environments. SSL-VPN portals are accessible on public IPs and easily fingerprinted by scanners. High-profile vulnerabilities in SonicOS have put SonicWall on every attacker's target list. Even fully patched units face relentless credential-stuffing campaigns from botnets using leaked password databases.
ThreatListPro maintains a blocklist, checked for new attackers every 6 hours, of IPs observed attacking production Palo Alto GlobalProtect VPN portals in the US. By importing this list into your SonicWall as an address group and applying a deny rule, you block attackers at the network layer before they can reach your VPN portal. No TLS handshake, no login page, no resource consumption.
Load ThreatListPro as a Dynamic External Address Group in SonicOS 7, then deny traffic from it.
Sign up at threatlistpro.com and copy your unique feed URL:https://api.threatlistpro.com/v1/YOUR_API_KEY/blocklist.txt
To test first, use the free 200-entry sample: https://api.threatlistpro.com/v1/sample/blocklist.txt
In SonicOS 7, go to OBJECT > Match Objects > Dynamic Group and click Add. Name it ThreatListPro (SonicOS adds the DEAG_ prefix), choose the WAN zone, leave FQDN off, enable Periodic Download with a 1 hour interval, set Protocol to HTTPS and paste your feed URL as the URL Name. Save.
Open DEAG_ThreatListPro and confirm its member count matches the list. Each entry becomes a read-only address object, and SonicOS caps these at 25% of the model's address-object limit, so smaller TZ models may hold only part of the list. On SonicOS 6.5 and older, which has no Dynamic Group, import the list under Object > Address Objects or sync it with the SonicOS API.
Go to Policy > Rules and Policies > Access Rules. Create a new rule: source zone WAN, source address set to your ThreatListPro address group, destination Any (or your VPN interface), action Deny. Place this rule at the top of your WAN-to-WAN or WAN-to-LAN policy.
Navigate to Investigate > Logs and filter for dropped connections. You should see entries matching the ThreatListPro address group. Check the access rule's hit counter to see how many connections it has dropped.
Compare automated VPN-focused blocking against other approaches for protecting your SonicWall firewall.
| Feature | ThreatListPro | Manual Blocking | Enterprise Threat Feeds |
|---|---|---|---|
| VPN brute-force focused | ✓ | ✗ | ✗ |
| Checked for new attackers every 6 hours | ✓ | ✗ | ✓ |
| Loads as a SonicOS 7 Dynamic Group | ✓ | ✗ | ✓ |
| No scripting or automation needed | ✓ | ✗ | ✓ |
| Setup in under 5 minutes | ✓ | ✗ | ✗ |
| Price | $9.99/mo | Staff time | $500+/mo |
On SonicOS 7, create a Dynamic External Address Group (OBJECT > Match Objects > Dynamic Group) with protocol HTTPS and your ThreatListPro feed URL, and enable Periodic Download. SonicOS downloads the list on the interval you pick and turns each entry into a read-only address object. Then create an access rule that denies traffic from that group. On SonicOS 6.5 and older, import the list as address objects instead.
Yes. On SonicOS 7 (Gen 7 TZ, NSa and NSsp) the feed loads as a Dynamic External Address Group. Each entry becomes an address object, and SonicOS caps these at 25% of the model's address-object limit, so on smaller TZ models check that the group's member count matches the list. SonicOS 6.5 and older has no URL-based groups: import the list as address objects or sync it with a script.
Yes. ThreatListPro blocks known brute force attacker IPs at the firewall level, which protects all services including SSL-VPN portal, Global VPN Client (IPsec), and any other management interfaces. The block occurs before the attacker can initiate a VPN handshake.
Stop brute force bots with an automated blocklist. No scripting required.
Get ThreatListPro -- $9.99/moThreatListPro provides a standard IP blocklist feed compatible with any firewall that supports external lists.
Learn more about IP blocklists, VPN security, and how ThreatListPro compares to alternatives.