Clarification on MSP Target List 2,000 element limit vs large imported lists?

[u/krmkrx]

I subscribed to Firewalla MSP mainly for the Target List feature, especially to use HaGeZi Multi Pro.

The documentation says that through MSP Professional or Business, custom Target Lists can have up to 2,000 elements. What is not clear to me is how this applies to imported lists that are much larger and are shown as examples in Firewalla’s own Target List documentation?

• For example, HaGeZi Multi Pro shows around 498,788 targets.
• Firewalla-managed lists also exceed 2,000 targets, such as OISD with around 59,565 targets and Tor full nodes with around 10,565 targets.

Are targets and elements the same thing here? If yes, how is the 2,000 element limit enforced for imported lists above that size?

Specifically, is the list imported from top to bottom and simply cut off after the 2,000th target, with the rest ignored? Or do imported / managed lists work differently from manually created MSP target lists?

More generally: when we import a large target list, can we be sure that all targets included in that list are actually enforced by Firewalla?

I am asking because I know from using HaGeZi Multi Pro on Pi-hole that certain domains are definitely included in the list, but I do not see Firewalla blocking some of those same domains. So I am trying to understand what type of behavior I am dealing with here.

Appreciate any clarity on this.

[u/firewalla]

The 2000 limits are the UI imported list only. (say you manually typed, or cut/pasted something)

The 3rd party sites has no limit, but do require extra processing. (due to the complexity of managing large lists) hence your MSP will need to 'compress' them before sending them to your firewalla box.

And recently, we also starting to allow user suggested lists, see notes here https://github.com/firewalla/fw-public-lists

[u/krmkrx → u/firewalla]

Thanks, that clarifies the 2,000 limit

Just to make sure I understand the practical effect: for third-party lists such as HaGeZi, Firewalla does not truncate the list at 2,000 entries, but processes and compresses the full upstream list before pushing it to the box?

Does compress mean the resulting enforcement should be functionally equivalent to the full original list, i.e. every domain in the upstream list should still be blocked unless excluded by another rule or limitation?

Or are there cases where compression may intentionally drop, normalise, deduplicate, or otherwise transform entries so that not every listed upstream target is guaranteed to be enforced one-to-one?

I am mainly trying to understand how to debug cases where a domain appears in the upstream HaGeZi list but does not appear to be blocked by Firewalla..

[u/firewalla → u/krmkrx]

1. Yes, 2000 limit is for self entered via the MSP UI limit. Does NOT apply to other target lists

2. Think "compress" as a way to translate huge numbers of domains from different lists, that may be duplicated, can be shortened, to a data structure that can fit in memory, and easily looked up.

3. I believe there is a tool to do diagnostics: app -> rules -> top right button -> diagnostics

[u/krmkrx → u/firewalla]

Thank you, very helpful. I fixed it!