russia-blocked-geoip turns a block list into eight router formats

One source list, republished into every format a client understands

The project description states the model plainly: a list of addresses and networks blocked by Roskomnadzor in geoip.dat, MaxMind mmdb, sign-box srs and nginx allow and deny formats, updated automatically every 6 hours.

The data itself comes from elsewhere. The primary source is antifilter.download and community.antifilter.download, and a third source is the re:filter project at 1andrevich/Re-filter-lists. So this is a conversion and republication pipeline, not a list that anyone curates here.

The output formats are what make it useful. There is `geoip.dat` for V2Ray, Xray-core and v2rayN and others, MaxMind `mmdb`, sing-box `srs`, mihomo `mrs`, Clash rules, SURGE rules, and nginx allow and deny templates. Each of those corresponds to a client with a completely different configuration mechanism, and the reason the project exists is that the same block list has to be expressed in each of them.

The download section gives two mirrors for every file, a raw GitHub URL and a jsDelivr URL:

https://raw.githubusercontent.com/runetfreedom/russia-blocked-geoip/release/geoip.dat
https://cdn.jsdelivr.net/gh/runetfreedom/russia-blocked-geoip@release/geoip.dat

That pairing is not a convenience detail. The whole point of a block list is that it is consumed by something running on your network, and a mirror on a different CDN is insurance against one host being slow or unreachable from where you are. The documentation says that the latest version of the file is always available at these addresses.

Three block categories and ten convenience ones

The category structure is the part that decides what you download, and it is more careful than it first looks.

The three primary categories are the actual block lists. `ru-blocked` contains `ipresolve.lst` and `subnet.lst` from the antifilter.download service. `ru-blocked-community` contains `community.lst` from the community.antifilter.download service and IPv6 subnets for Telegram. And `re-filter` contains `ipsum.lst` from the re:filter project.

Telegram deserves a note, because it is the one case where a messaging service is on the blocked list via IPv6 subnets, which is a different category of thing from a site being unreachable.

Then there are the convenience categories, included for your convenience as the documentation puts it. There are `geoip:cloudflare`, `geoip:cloudfront`, `geoip:facebook`, `geoip:fastly`, `geoip:google`, `geoip:netflix`, `geoip:telegram`, `geoip:twitter`, `geoip:ddos-guard` and `geoip:yandex`.

These are the addresses of large services, and including them in a routing table is a way of routing around a block that applies to the whole provider rather than to one hostname. Whether you want that is a routing decision, and having them as separate categories rather than baked into the blocked list is what lets you choose.

The categories are also the unit of the file taxonomy, and the documentation states the principle explicitly: in all directories the content is split by the principle of 1 file equals 1 category. The directories are `dat` for the geoip.dat format, `text` for plain text lists, `srs` for the sing-box format, `clash` for the Clash format including both the classic and the ip-cidr notation, `mrs` for the mihomo format, `surge` for the SURGE format, and `nginx` for allow and deny rules.

Which file to fetch depends on how much you want in one download

There are six geoip.dat-family files and each answers a different question, so the choice is worth understanding.

`geoip.dat` and `Country.mmdb` contain the full data set, the original geoip plus all the categories. `geoip-asn.dat` and `Country-asn.mmdb` contain only the additional categories. `geoip-ru-only.dat` and `Country-ru-only.mmdb` contain only the lists of blocked networks and addresses. And then `ru-blocked.dat`, `ru-blocked-community.dat` and `re-filter.dat` are the corresponding individual categories, in the geoip.dat format only.

So the taxonomy is a set of inclusion choices. The full file is for a client where you want the provider categories and the block lists together. The additional-categories file is for a client that already has its own geoip data and wants the extras layered on. The ru-only file is the narrow one, just the blocks. And the three single-category files are for a client where you want one specific list and nothing else.

There is also `private.dat`, which holds private and reserved networks per RFC 6890. That is a standard geoip category and it is published here because clients that load a custom geoip file sometimes need the private ranges carried along.

The file naming is not obvious, and getting it wrong means either downloading far more than you need or missing the block list entirely while thinking you have it. The `asn` suffix on the second pair is about additional categories rather than about autonomous system data, which is the sort of naming that only makes sense once you have read the list.

The nginx templates are the odd one out, and the useful one

Six of the seven output formats are for proxy clients, and the seventh is for a web server, which is why the nginx entry deserves its own look.

The nginx output is allow and deny rules, published in the `nginx` directory alongside the other formats. A rule file for nginx is not the same shape as a geoip database. A geoip.dat is a binary table a client consults at runtime to decide which route a destination belongs to, whereas an nginx allow or deny list is a text file of entries you include in a server configuration to reject requests from or to particular addresses.

That is a different job. A proxy client using a geoip file decides where to send traffic, and a blocked entry means route it elsewhere. An nginx rule decides whether to serve a request at all, and a denied entry means the request never gets a response.

The practical case is a service that wants to refuse traffic originating from blocked ranges, or a server operator who wants to avoid serving a request that comes from a network on the list. For a self-hosted service that is a reasonable thing to want, and building it from the same source data means the two stay in step.

The text directory is worth pairing with it. Plain text lists are the format that anything can consume, and they are what you would diff between two releases to see exactly what changed in the block list, which is a question the binary formats cannot answer cheaply.

Six hour refresh, and release tags that show it

The refresh interval is stated in both the description and the documentation: every 6 hours, the project automatically generates the GeoIP files.

The release history shows how that works in practice. The recent tags are 202610200820 from 2026-10-20 at 08:22, 202610200010 from 2026-10-20 at 00:12, and 202610191620 from 2026-10-19 at 16:22. The tag names are timestamps in a compact form, year, month, day, hour, minute, so they sort chronologically and they tell you exactly when the data was rebuilt.

The gaps between those three are around eight hours and sixteen hours, not a strict six. So the six-hour figure is a target and the actual cadence varies, which is what you would expect of a job that pulls from upstream lists and then converts them into eight formats. If you are scheduling your own updates, the safe assumption is that anything older than a day is stale.

The last push to the repository was on 2026-10-20, so the pipeline itself is actively maintained rather than a one-off export.

The repository is small, and the smallness is informative. The top-level entries are a .github/ directory, a .gitignore, the LICENSE, the Readme.md and config.json. There is no generator source in the tree, so the conversion code lives elsewhere, which is also the pattern for the related projects listed in the documentation: russia-v2ray-rules-dat as a single source of geo files for v2ray, xray and sing-box, russia-blocked-geosite for generating geosite files, russia-v2ray-custom-routing-list for routing rules for various clients, and geodat2srs as a converter from geoip and geosite dat files into sing-box srs.

Editorial conclusion

Adopt russia-blocked-geoip if you run a proxy client or a router that needs the current Roskomnadzor address list in its own file format, since the project republishes one source list into eight formats and refreshes every six hours. Skip it if you want a curated manual list, because this is a mirror of upstream lists rather than an editorial product. Verify first that your client reads one of the published formats, that you fetch the category you actually want rather than the full geoip.dat, and that your update interval is compatible with the six-hour cadence, since the release tags show a rebuild roughly every four hours.

Frequently asked questions

Official sources

1. Issues
2. License: GPL-3.0
3. README
4. Releases
5. runetfreedom/russia-blocked-geoip on GitHub