∞ cat /etc/cron.daily/iptables-rbl
#!/bin/sh
TARGET_SET=vpn-whitelist
TARGET_TMP=vpn-whitelist-tmp
ipset destroy -q ${TARGET_TMP} || true
ipset create -q ${TARGET_SET} hash:ip || true
ipset create ${TARGET_TMP} hash:ip
wget -O - https://reestr.rublacklist.net/api/ips | \
awk '{gsub(/"/,"",$1); gsub(";"," ",$1); print $1}' | \
xargs -n1 ipset add ${TARGET_TMP}
ipset swap ${TARGET_TMP} ${TARGET_SET}
ipset destroy ${TARGET_TMP}
∞ cat /etc/local.d/70-iptables-rbl.start
#!/bin/sh
/etc/cron.daily/iptables-rbl
iptables -t mangle -A PREROUTING -i br0 -m set --match-set vpn-whitelist dst -j MARK --set-xmark 0x2
А дальше всё как обычно: https://bnw.im/p/XK17TW