IPSet Cheatsheet

ipset is a companion application for the iptables Linux firewall. It allows you to create, maintain, and inspect "IP sets" — arrays of IP addresses, MAC addresses, or port numbers. Matching against a set is extremely fast compared to sequential iptables rules, even with thousands of entries.

Installation

# Debian / Ubuntu
sudo apt install ipset
 
# RHEL / CentOS / Fedora
sudo dnf install ipset
 
# Arch Linux
sudo pacman -S ipset

Set Types

ipset supports several set types. The most common ones:

Set Type	Stores	Example Use Case
`hash:ip`	Individual IP addresses	Blacklist specific IPs
`hash:net`	Network subnets (CIDR)	Block entire subnets
`hash:ip,port`	IP + port combinations	Allow specific IPs to specific ports
`hash:net,port`	Subnet + port combinations	Subnet-level port access
`list:set`	Other sets (set of sets)	Combine multiple sets

Creating Sets

# Create a set for individual IP addresses
sudo ipset create blacklist hash:ip
 
# Create a set for network subnets
sudo ipset create bad_subnets hash:net
 
# Create a set with a maximum number of elements (default: 65536)
sudo ipset create blacklist hash:ip maxelem 131072
 
# Create a set where entries auto-expire after a timeout (in seconds)
sudo ipset create tempban hash:ip timeout 3600

Modifying Sets

# Add an IP to the set
sudo ipset add blacklist 192.168.1.50
 
# Add with a custom timeout (overrides set default, requires set created with timeout)
sudo ipset add tempban 10.0.0.5 timeout 7200
 
# Add a subnet to a hash:net set
sudo ipset add bad_subnets 10.0.0.0/8
 
# Test if an IP is in the set (returns 0 if found, 1 if not)
sudo ipset test blacklist 192.168.1.50
 
# Delete an IP from the set
sudo ipset del blacklist 192.168.1.50

Listing and Inspecting

# List all sets with their members
sudo ipset list
 
# List a specific set
sudo ipset list blacklist
 
# List only set names (no members)
sudo ipset list -name
 
# Show only the number of entries in a set
sudo ipset list blacklist | grep "Number of entries"

Flushing and Destroying

# Flush (empty) all entries from a set
sudo ipset flush blacklist
 
# Destroy (delete) a specific set (must not be referenced by iptables)
sudo ipset destroy blacklist
 
# Destroy all sets
sudo ipset destroy

Using IPSet with Iptables

Reference a set in a single iptables rule instead of creating one rule per IP.

# Drop all incoming traffic from IPs in the "blacklist" set
sudo iptables -A INPUT -m set --match-set blacklist src -j DROP
 
# Drop traffic where both source IP and destination port match
sudo iptables -A INPUT -m set --match-set blocked_services src,dst -j DROP

Saving and Restoring

Sets are stored in memory and lost on reboot. Save and restore them manually or via systemd.

# Save all sets to a file
sudo ipset save > /etc/ipset.conf
 
# Restore sets from a file
sudo ipset restore < /etc/ipset.conf

Persistent via systemd

Create a systemd service or use the ipset service if available:

# Debian / Ubuntu (with ipset-persistent)
sudo apt install ipset-persistent
sudo ipset save > /etc/ipset/rules.v4
 
# Arch Linux — enable the built-in ipset service
sudo systemctl enable ipset

Cheatsheets