Iptables ipset 使用经验: Difference between revisions

From 清冽之泉
Jump to navigation Jump to search
← Older editNewer edit →
VisualWikitext
No edit summary
Line 20: Line 20:
<syntaxhighlight lang="bash">
<syntaxhighlight lang="bash">
ipset create mw_white hash:ip family inet hashsize 4096 maxelem 131072 -exist
ipset create mw_white hash:ip family inet hashsize 4096 maxelem 131072 -exist
iptables -C INPUT -m set --match-set mw_white src -j ACCEPT 2>/dev/null || \
iptables -I INPUT 1 -m set --match-set mw_white src -j ACCEPT
iptables -I INPUT 1 -m set --match-set mw_white src -j ACCEPT
ipset list mw_white
ipset list mw_white
Line 25: Line 26:
ipset add mw_white 1.2.3.4 -exist
ipset add mw_white 1.2.3.4 -exist
ipset del mw_white 1.2.3.4
ipset del mw_white 1.2.3.4
ipset save > /etc/iptables/ipsets
iptables-save > /etc/iptables/rules.v4
</syntaxhighlight>
</syntaxhighlight>


Line 30: Line 33:
<syntaxhighlight lang="bash">
<syntaxhighlight lang="bash">
ipset create mw_ban hash:ip family inet hashsize 4096 maxelem 131072 timeout 86400 -exist
ipset create mw_ban hash:ip family inet hashsize 4096 maxelem 131072 timeout 86400 -exist
iptables -C INPUT -m set --match-set mw_ban src -j DROP 2>/dev/null || \
iptables -I INPUT 2 -m set --match-set mw_ban src -j DROP
iptables -I INPUT 2 -m set --match-set mw_ban src -j DROP
ipset list mw_ban
ipset list mw_ban
ipset test mw_ban 1.2.3.4
ipset test mw_ban 1.2.3.4
ipset add mw_ban 1.2.3.4 -exist
ipset add mw_ban 1.2.3.4/24 -exist
ipset add mw_ban 1.2.3.0/24
ipset del mw_ban 1.2.3.4
ipset del mw_ban 1.2.3.4
ipset save > /etc/iptables/ipsets
iptables-save > /etc/iptables/rules.v4
</syntaxhighlight>
</syntaxhighlight>


Revision as of 14:56, 10 July 2026

iptables 加上 ipset，对大批量地屏蔽恶意 ip，非常有用。ipset 负责建立一个 ip 集合，比如白名单集合、黑名单集合；iptables 规则负责对该集合做放行或封禁处理。

查看靠前的链： iptables -L -n | head

核心逻辑

前提是先安装好用到的软件：apt install ipset iptables netfilter-persistent ipset-persistent iptables-persistent

  1. 临时
    1. ipset create：创建一个名单，如 mw_white
    2. ipset add：往名单里加 IP
    3. iptables -C：检查规则是否已存在
    4. iptables -I：改内存里的防火墙规则
  2. 保存
    1. ipset save > /etc/iptables/ipsets：把名单名字、成员持久化
    2. iptables-save > /etc/iptables/rules.v4：把防火墙规则持久化
  3. 自动重生
    1. systemctl enable netfilter-persistent：让开机时自动读取上述文件并恢复

白名单

ipset create mw_white hash:ip family inet hashsize 4096 maxelem 131072 -exist
iptables -C INPUT -m set --match-set mw_white src -j ACCEPT 2>/dev/null || \
iptables -I INPUT 1 -m set --match-set mw_white src -j ACCEPT
ipset list mw_white
ipset test mw_white 1.2.3.4
ipset add mw_white 1.2.3.4 -exist
ipset del mw_white 1.2.3.4
ipset save > /etc/iptables/ipsets
iptables-save > /etc/iptables/rules.v4

黑名单

ipset create mw_ban hash:ip family inet hashsize 4096 maxelem 131072 timeout 86400 -exist
iptables -C INPUT -m set --match-set mw_ban src -j DROP 2>/dev/null || \
iptables -I INPUT 2 -m set --match-set mw_ban src -j DROP
ipset list mw_ban
ipset test mw_ban 1.2.3.4
ipset add mw_ban 1.2.3.4/24 -exist
ipset del mw_ban 1.2.3.4
ipset save > /etc/iptables/ipsets
iptables-save > /etc/iptables/rules.v4

速率

活着

要想 ipset 活着，必须保证以下：

  1. 关机前 ipset 改后的规则已保存 ipset save > /etc/ipset.conf
  2. 关机前 iptables 改后的规则已保存 iptables-save > /etc/iptables/rules.v4
  3. 开机后 ipset 规则已恢复 ipset restore -exist < /etc/ipset.conf
  4. 开机后 iptables 规则已恢复 iptables-restore < /etc/iptables/rules.v4

自动化

以下脚本未经完全测试，暂勿使用。

自动脚本： 因为 iptables-persistent 只管 iptables，不管 ipset，所以要建一个 ipset 的自动恢复脚本。 

# 放进 /etc/systemd/system/ipset-restore.service
[Unit]
Description=Restore IP sets
Before=netfilter-persistent.service

[Service]
Type=oneshot
ExecStart=/usr/sbin/ipset restore
StandardInput=file:/etc/ipset.conf
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target

最后重启服务： 

systemctl daemon-reload
systemctl enable ipset-restore
Retrieved from "https://qingliezhiquan.com/index.php?title=Iptables_ipset_使用经验&oldid=11284"