Iptables ipset 使用经验

From 清冽之泉
Revision as of 15:36, 29 April 2026 by Mwroot (talk | contribs) (Created page with "== 白名单 == <syntaxhighlight lang="bash"> ipset create mw_white hash:ip family inet hashsize 4096 maxelem 131072 ipset list mw_white ipset test mw_white 1.2.3.4 ipset add mw_white 1.2.3.4 -exist ipset del mw_white 1.2.3.4 </syntaxhighlight> <code>iptables -I INPUT 1 -m set --match-set mw_white src -j ACCEPT</code> 令白名单规则排第一条。 == 黑名单 == <syntaxhighlight lang="bash"> ipseet create mw_ban hash:ip family inet hashsize 4096 maxelem 131072 tim...")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to navigation Jump to search

白名单

ipset create mw_white hash:ip family inet hashsize 4096 maxelem 131072
ipset list mw_white
ipset test mw_white 1.2.3.4
ipset add mw_white 1.2.3.4 -exist
ipset del mw_white 1.2.3.4

iptables -I INPUT 1 -m set --match-set mw_white src -j ACCEPT 令白名单规则排第一条。

黑名单

ipseet create mw_ban hash:ip family inet hashsize 4096 maxelem 131072 timeout 86400
ipset list mw_ban
ipset test mw_ban 1.2.3.4
ipset add mw_ban 1.2.3.4 -exist
ipset del mw_ban 1.2.3.4

iptables -I INPUT 2 -m set --match-set mw_ban src -j DROP 令黑名单规则排第二条。

速率

重启

ipset save > /etc/ipset.conf # 保存规则
ipset restore < /etc/ipset.conf # 手动恢复

自动脚本： 因为 iptables-persistent 只管 iptables，不管 ipset，所以要建一个 ipset 的自动恢复脚本。 

# 放进 /etc/systemd/system/ipset-restore.service
[Unit]
Description=Restore IP sets
Before=netfilter-persistent.service
Wants=netfilter-persistent.service

[Service]
Type=oneshot
ExecStart=/usr/sbin/ipset restore < /etc/ipset.conf
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target

最后重启服务： 

systemctl daemon-reload
systemctl enable ipset-restore
Retrieved from "https://qingliezhiquan.com/index.php?title=Iptables_ipset_使用经验&oldid=10875"