Iptables ipset 使用经验: Difference between revisions
Jump to navigation
Jump to search
No edit summary |
|||
| Line 1: | Line 1: | ||
== 白名单 == | == 白名单 == | ||
<syntaxhighlight lang="bash"> | <syntaxhighlight lang="bash"> | ||
ipset create mw_white hash:ip family inet hashsize 4096 maxelem 131072 | ipset create mw_white hash:ip family inet hashsize 4096 maxelem 131072 -exist | ||
iptables -I INPUT 1 -m set --match-set mw_white src -j ACCEPT | |||
ipset list mw_white | ipset list mw_white | ||
ipset test mw_white 1.2.3.4 | ipset test mw_white 1.2.3.4 | ||
| Line 7: | Line 8: | ||
ipset del mw_white 1.2.3.4 | ipset del mw_white 1.2.3.4 | ||
</syntaxhighlight> | </syntaxhighlight> | ||
== 黑名单 == | == 黑名单 == | ||
<syntaxhighlight lang="bash"> | <syntaxhighlight lang="bash"> | ||
ipset create mw_ban hash:ip family inet hashsize 4096 maxelem 131072 timeout 86400 | ipset create mw_ban hash:ip family inet hashsize 4096 maxelem 131072 timeout 86400 -exist | ||
iptables -I INPUT 2 -m set --match-set mw_ban src -j DROP | |||
ipset list mw_ban | ipset list mw_ban | ||
ipset test mw_ban 1.2.3.4 | ipset test mw_ban 1.2.3.4 | ||
| Line 18: | Line 18: | ||
ipset del mw_ban 1.2.3.4 | ipset del mw_ban 1.2.3.4 | ||
</syntaxhighlight> | </syntaxhighlight> | ||
== 速率 == | == 速率 == | ||
Revision as of 16:57, 29 April 2026
白名单
ipset create mw_white hash:ip family inet hashsize 4096 maxelem 131072 -exist
iptables -I INPUT 1 -m set --match-set mw_white src -j ACCEPT
ipset list mw_white
ipset test mw_white 1.2.3.4
ipset add mw_white 1.2.3.4 -exist
ipset del mw_white 1.2.3.4
黑名单
ipset create mw_ban hash:ip family inet hashsize 4096 maxelem 131072 timeout 86400 -exist
iptables -I INPUT 2 -m set --match-set mw_ban src -j DROP
ipset list mw_ban
ipset test mw_ban 1.2.3.4
ipset add mw_ban 1.2.3.4 -exist
ipset del mw_ban 1.2.3.4
速率
重启
ipset save > /etc/ipset.conf # 保存规则
ipset restore < /etc/ipset.conf # 手动恢复
自动脚本： 因为 iptables-persistent 只管 iptables，不管 ipset，所以要建一个 ipset 的自动恢复脚本。
# 放进 /etc/systemd/system/ipset-restore.service
[Unit]
Description=Restore IP sets
Before=netfilter-persistent.service
Wants=netfilter-persistent.service
[Service]
Type=oneshot
ExecStart=/usr/sbin/ipset restore < /etc/ipset.conf
RemainAfterExit=yes
[Install]
WantedBy=multi-user.target
最后重启服务：
systemctl daemon-reload
systemctl enable ipset-restore