ipset Firewall Cheatsheet

# Debian/Ubuntu
apt-get install ipset
 
# RHEL/CentOS
yum install ipset
 
# Arch
pacman -S ipset

# Hash:IP (default — single IPs)
ipset create blocklist hash:ip
 
# Hash:Net (CIDR ranges)
ipset create whitelist hash:net
 
# List:Set (with timeout support)
ipset create tempblock list:set timeout 300
 
# Bitmap:Port (port ranges)
ipset create blocked-ports bitmap:port range 0-65535

# Add entries
ipset add blocklist 192.168.1.100
ipset add blocklist 10.0.0.0/24
ipset add blocklist 192.168.1.0/24 nomatch   # Exclude subnet
ipset add tempblock 203.0.113.50 timeout 3600  # Auto-expire in 1h
 
# Remove entries
ipset del blocklist 192.168.1.100
 
# Test entry
ipset test blocklist 192.168.1.100
 
# List entries
ipset list blocklist
 
# List all sets
ipset list
 
# Flush set
ipset flush blocklist
 
# Destroy set
ipset destroy blocklist

# Block all IPs in blocklist
iptables -A INPUT -m set --match-set blocklist src -j DROP
 
# Whitelist (allow before blocks)
iptables -A INPUT -m set --match-set whitelist src -j ACCEPT
 
# With nftables
nft add rule inet filter input ip saddr @blocklist drop
nft add rule inet filter input ip saddr @whitelist accept

# Save sets
ipset save > /etc/ipset.rules
 
# Restore sets
ipset restore < /etc/ipset.rules
 
# Auto-restore on boot (Debian/Ubuntu)
# Add to /etc/rc.local or systemd service
ipset restore < /etc/ipset.rules
 
# Create systemd service
cat > /etc/systemd/system/ipset-restore.service << 'EOF'
[Unit]
Description=Restore ipset rules
Before=network-pre.target
 
[Service]
Type=oneshot
ExecStart=/sbin/ipset restore -file /etc/ipset.rules
RemainAfterExit=yes
 
[Install]
WantedBy=multi-user.target
EOF

# Create set for bad IPs
ipset create blacklist hash:ip timeout 86400  # Auto-expire in 24h
 
# Block them
iptables -A INPUT -m set --match-set blacklist src -j DROP
 
# Script to add IPs dynamically
ipset add blacklist $ATTACKER_IP
ipset add blacklist $ANOTHER_IP timeout 3600  # 1 hour ban
 
# Check current blocklist size
ipset list blacklist | wc -l