RTBH automation for network operators

Controlled RTBH
route automation.

blackhole-threats turns local and remote threat feeds into IPv4 and IPv6 blackhole announcements, with deterministic route deltas, per-community policy boundaries, and last-known-good protection when a source fails.

Install from signed APT Read the operator guide

Signed APT
GHCR image
Per-community policy
IPv4 / IPv6

blackhole-threats — refresh.log live

blackhole-threats v1.2.3 · AS64520
INFO  feeds loaded          count=5  community=64520:666
INFO  prefixes parsed       ipv4=98,421  ipv6=30,321
INFO  routes summarised     total=128,742  overlaps=-421
INFO  route delta           announced=1,245  withdrawn=312
WARN  feed retry deferred   failed_feeds=1  carry_forward=true
INFO  refresh complete      duration=412ms  next_refresh=5m

Illustrative refresh output — values shown for orientation.

Current release

Signed releases with visible provenance.

Version ---

Commit ---

Build date ---

APT signing key ---

Release highlights

Loading release highlights...

How it runs

A small, auditable refresh loop with conservative failure handling.

Normalise feed input

Read local files, HTTP, and HTTPS sources in plain text, JSON arrays, JSONL, or NDJSON.

Publish only route deltas

Build the desired table, compare to active state, then withdraw stale routes and announce changes only.

Keep policy boundaries explicit

Group feeds by BGP community so policy boundaries stay explicit and auditable on the wire.

Preserve last-known-good routes

When a community refresh fails, preserve its last known-good routes and retry on the next cycle.

Install

Choose the delivery path for your environment.

Signed APT is the recommended path for long-running Debian-family hosts. Use GHCR for container runtimes with configuration mounted under /config.

bash

Loading signed APT commands...

Recommended

Installs the binary, systemd unit, default environment file, man page, sample config, and packaged documentation.