Manage IP sets for efficient firewall rule matching.
high risk
ipset save > /root/ipset.backupBack up the sets.ipset creates named sets of IP addresses, networks, or ports that iptables/nftables rules can reference. Instead of hundreds of individual iptables rules, one ipset contains thousands of IPs and one rule matches the entire set — dramatically faster packet processing.
ipset create blocklist hash:ipCreate a set of blocked IPs · explain & risk-check →ipset add blocklist 203.0.113.5Add an IP to the blocklist set · explain & risk-check →iptables -I INPUT -m set --match-set blocklist src -j DROPDrop all traffic from IPs in the set · explain & risk-check →ipset list blocklistShow all entries in a set · explain & risk-check →ipset save > /etc/ipset.conf && ipset restore < /etc/ipset.confSave and restore sets across reboots · explain & risk-check →Use `ipset` with `hash:net` type for CIDR blocks — combine with country IP lists (like MaxMind) in a cron job to auto-block entire country ranges without thousands of iptables rules.
Reference text is hand-written and may be incomplete — check man ipset for your version. Test destructive commands on a non-production system first.