Skynet Skynet - Removing old ips from a previous import

[johnsmallberries]

I've looked through the threads but couldn't find the recommended procedure for removing a previously imported blacklist of ips from a file. If I use option 5 or the firewall command to import a list of ip's from a local file, and then later want to update that list, the original ip's are still in skynet. They get tagged with a name if provided on the command line, or if you used option 5 then it just uses the date, i.e. "comment "Imported: Oct 02 21:43:30". So if you update a blacklist that you have obtain from somewhere, and an ip that was once on the list is no longer there, how are you supposed to purge or get rid of the old ips? Skynet stores imported ips in a file "skynet.ipset". Am I supposed to just grep that file for the list name that i imported, and remove all the ips before re-importing that list?
Thanks.

 

[dave14305]

Wouldn’t you just use option 6 (Deport)?

 

[johnsmallberries]

Is that the workflow? I would have to keep the previous list I guess?
For example, if I import a list from abuseipdb on the first of the month, and now 3 months later I want to update the list.
I don't know which IPs from abuseipdb may no longer be on their list, so you are saying I should keep the old list from 3 months ago and "deport" it, and then load the new one? I also noticed that when i import a list it will "dedup" against existing ips from other sources, so if I deport a manual list that contains those other ips, I don't want to delete them also.

I was hoping, since the ips are "tagged" by name or date, that I could just say delete by "tagged" and import the list again. It seems like I could just grep skynet.ipset and remove them if that would work.
Maybe I could just drop the list of ips into a file in the "lists" directory with firehol, spamhaus, etc... That way when I want to update my list I just overwrite that file.

 

[dave14305]

I don't think the import and deport functions have ever been widely used or understood. Most people will just create and host a custom filter.list that includes the additional lists they want to ban.