Ipset - Block thousands of IP with iptables

Block efficiently thousands of IPs, IPs and MACs pairs and TCP and UDP ports with a single iptables rule, making use of a feature available since the 2.6.x kernel version called ipset.

By: Jakson Wilker

INTRODUCTION TO IPSET

The ipset is a feature introduced in 2.6.x kernel since version that allows you to create sets to store lists of IPs, IPs and MACs pairs and TCP / UDP ports. 

By using this feature you can block thousands of IPs in iptables only with a rule. 

For this article I will use two virtual machines with CentOS 6.4 for execution of commands.

We first install the utility as ipset following command:

We first install the utility as ipset following command:

# Yum install ipset

CREATING SETS

Once installed, we will use the ipset command to create the sets:

# Ipset creates POOLNAME hash: ip

the option adds a new conjuto create (set) and the hash ip refers to the storage method and the data type to be stored separated by ":".

For all types of sets available just type the following command:

# Ipset help

You can also add a default timeout for the set of entries:

# Ipset create POOLNAME hash: ip timeout 300

So all IP added to the set will remain for 300 seconds to be removed.

To list all sets created type:

# Ipset list [POOLNAME]

To add a new record type:

# Ipset add IP POOLNAME [timeout n]

Obs .: You can only use the timeout option if you created the set with this option.

To clear the entire contents of any set type:

# Ipset flush POOLNAME

To remove a type set:

# ipset destroy POOLNAME

Before removing a set sure to remove

all references to this set in the firewall, or you will not be able to remove it.

After this brief introduction to some of the options ipset command, we create a set for our examples:

# Ipset creates ip_bloqueado hash: ip

with the above command created the "ip_bloqueado" set to use the hash method and store lists of IPs.

Now let's add some IPs in the set:

Okay, now we have 3 records in our set.

Let's create a new set to store pairs of ip and mac:

Note that there is a new option that is required for the type of set, this option defines the network that can be inserted into the set.

Now let's add a record in this set:

Let's run the following command to list our sets:

# Ipset list

The output of the command will be displayed as in the image below: