diff --git a/internal/db/models/ip_item_dao.go b/internal/db/models/ip_item_dao.go
index fc64be5f..115e2cfc 100644
--- a/internal/db/models/ip_item_dao.go
+++ b/internal/db/models/ip_item_dao.go
@@ -282,8 +282,6 @@ func (this *IPItemDAO) ListIPItemsAfterVersion(tx *dbs.Tx, version int64, size i
 	_, err = this.Query(tx).
 		// 这里不要设置状态参数，因为我们要知道哪些是删除的
 		Gt("version", version).
-		Where("(expiredAt=0 OR expiredAt>:expiredAt)").
-		Param("expiredAt", time.Now().Unix()).
 		Asc("version").
 		Asc("id").
 		Limit(size).
@@ -356,6 +354,8 @@ func (this *IPItemDAO) CountAllEnabledIPItems(tx *dbs.Tx, ip string, listId int6
 	}
 	return query.
 		State(IPItemStateEnabled).
+		Where("(expiredAt=0 OR expiredAt>:expiredAt)").
+		Param("expiredAt", time.Now().Unix()).
 		Count()
 }
 
@@ -372,6 +372,8 @@ func (this *IPItemDAO) ListAllEnabledIPItems(tx *dbs.Tx, ip string, listId int64
 	}
 	_, err = query.
 		State(IPItemStateEnabled).
+		Where("(expiredAt=0 OR expiredAt>:expiredAt)").
+		Param("expiredAt", time.Now().Unix()).
 		DescPk().
 		Offset(offset).
 		Size(size).
diff --git a/internal/rpc/services/service_ip_item.go b/internal/rpc/services/service_ip_item.go
index 3a9300cd..406f2e30 100644
--- a/internal/rpc/services/service_ip_item.go
+++ b/internal/rpc/services/service_ip_item.go
@@ -9,6 +9,7 @@ import (
 	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
 	"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs/firewallconfigs"
 	"net"
+	"time"
 )
 
 // IPItemService IP条目相关服务
@@ -328,6 +329,11 @@ func (this *IPItemService) ListIPItemsAfterVersion(ctx context.Context, req *pb.
 		return nil, err
 	}
 	for _, item := range items {
+		// 是否已过期
+		if item.ExpiredAt > 0 && int64(item.ExpiredAt) <= time.Now().Unix() {
+			item.State = models.IPItemStateDisabled
+		}
+
 		if len(item.Type) == 0 {
 			item.Type = models.IPItemTypeIPv4
 		}