Tips and Examples

Unordered list of some tips and examples:

  • In order to drop traffic to-from banned networks or IP addresses, use IP sets in the raw table of netfilter.
  • If you want to change a set without disturbing your existing iptables rules, simply swap it with the new set:
    # Create the new set and add the entries to it
    ipset -N new-set ....
    ipset -A new-set ....
    # Swap the old and new sets
    ipset -W old-set new-set
    # Get rid of the old set, which is now under new-set
    ipset -X new-set