ipset(8)
Manage IP sets – collections of IP addresses, networks, ports, or MAC addresses for use with netfilter firewall rules.
Synopsis
ipset [OPTIONS] COMMAND [COMMAND-OPTIONS] SETNAME [ELEMENTS]Description
ipset is a userspace utility that manages IP sets in the kernel. IP sets are efficient data structures for storing and matching collections of IP addresses, networks, ports, or MAC addresses. They are commonly used with iptables/netfilter to quickly match traffic against large lists of addresses without the performance penalty of many individual rules.
IP sets support various data types (hash:ip, hash:net, hash:port, list:set, etc.) and can be referenced by iptables rules for efficient filtering. Sets persist in kernel memory and can be saved/restored for persistence across reboots.
Common options
| Flag | What it does |
|---|---|
-N, --create | Create a new IP set with specified name and type |
-X, --destroy | Destroy specified IP set (all sets if none given) |
-A, --add | Add one or more elements to a set |
-D, --del | Delete one or more elements from a set |
-L, --list | List contents of specified set or all sets |
-S, --save | Save IP sets to stdout in a format suitable for restoration |
-R, --restore | Restore IP sets from stdin (batch mode) |
-F, --flush | Flush (empty) specified set or all sets |
-e, --exist | Exit silently if set already exists (with -N) or does not exist (with -X) |
-q, --quiet | Suppress output and error messages |
-n, --name | List only set names (with -L) |
-t, --terse | Output in terse form, one set per line (with -L) |
Examples
Create a new set named 'blacklist' to store IP addresses
ipset create blacklist hash:ipAdd two IP addresses to the blacklist set
ipset add blacklist 192.168.1.100 192.168.1.101Add multiple network ranges to a whitelist set
ipset add whitelist 10.0.0.0/8 10.1.0.0/16Display all members and statistics for the blacklist set
ipset list blacklistSave all current IP sets to a file for persistence
ipset save > /etc/ipset.confRestore IP sets from a saved configuration file
ipset restore < /etc/ipset.confUse an ipset with iptables to drop traffic from blacklisted IPs
iptables -A INPUT -m set --match-set blacklist src -j DROPDelete the blacklist set from kernel memory
ipset destroy blacklist