Use ipset with iptables to block inbound traffic

Use ipset with iptables to block inbound traffic

I find myself in need of automating the blocking of IPs that I find in mail and auth logs. The system it old enough I cannot install fail2ban. I figured out a way to make it happen with iptables and ipset instead. Read along as I provide the details about blocking inbound traffic using a list dynamically generate with ipset and read in by iptables.

I could suggest a way to feed iptables with list of IPs by using ipset.

you can simply create and ipset:

ipset create <ipset name> iphash

then you can add any IP to the set using:

ipset add <ipset name> IP

after that you can use the set in iptables:

/sbin/iptables --append INPUT -m set --match-set <ipset name> src -j DROP