firewalld iptables ipset 批量管理ip访问

netstat -nat|grep ":80"|awk '{print $5}' |awk -F: '{print $1}' | sort| uniq -c|sort -n

如果不想一些地区IP访问服务器可以通过ipset批量添加
1.安装
# yum install -y ipset
2.创建黑／白名单表
# ipset create blacklist hash:net (也可以是hash:ip)
3.往黑／白名单表添加IP地址
# ipset add blacklist 128.0.2.0/24
如果需要批量添加好多个可以用shell批量执行此命令

4.给iptables添加这个ip集
# iptables -I INPUT -m set --match-set blacklist src -p tcp --dport 80 -j DROP
5.然后在报错iptables就可以了
# iptables-save
6.查看集合
#ipset list blacklist

======
要在ip集里删除ip的命令
# ipset del blacklist 128.0.2.0/24
删除IP集
# ipset destroy blacklist

1、手动创建ipset配置文件
注意：集合命名规范：permit_端口_input
系统默认没有ipset配置文件，需要手动创建ipset配置文件
mkdir -p /etc/firewalld/ipsets/permit_22_input.xml permit_22_input就是ipset名称


white-list
192.168.1.1
192.168.1.2



=============
centos7

To create the ipset blacklist for IPv4:创建黑名单

firewall-cmd --permanent --new-ipset=blacklist --type=hash:ip

type类型(1、hash:ip
2、hash:ip,mark
3、hash:ip,port
4、hash:ip,port,ip
5、hash:ip,port,net
6、hash:mac
7、hash:net
8、hash:net,iface
9、hash:net,net
10、hash:net,port
11、hash:net,port,net
)

Reload to make the ipset usable in runtime environment:重载配置

firewall-cmd --reload

Add runtime only entries to the blacklist:往黑名单set里添加记录

firewall-cmd --ipset=blacklist --add-entry=192.168.1.4
firewall-cmd --ipset=blacklist --add-entry=192.168.1.6
firewall-cmd --ipset=blacklist --add-entry=192.168.1.8
firewall-cmd --ipset=blacklist --add-entry=192.168.1.10

Add a rich rule in the default zone for dropping all entries on the blacklist: 丢弃黑名单的访问

firewall-cmd --add-rich-rule='rule source ipset=blacklist drop'

To create the ipset blacklist6 for IPv6:

firewall-cmd --permanent --new-ipset=blacklist6 --type=hash:ip --option=family=inet6

The option family needs to be set to inet6 to make sure that the ipset is using IPv6 addresses.

Reload to make the ipset usable in runtime environment:

firewall-cmd --reload

Add runtime only entries to the blacklist6:

firewall-cmd --ipset=blacklist6 --add-entry=fe80::07FF:0004
firewall-cmd --ipset=blacklist6 --add-entry=fe80::07FF:0006
firewall-cmd --ipset=blacklist6 --add-entry=fe80::07FF:0008
firewall-cmd --ipset=blacklist6 --add-entry=fe80::07FF:0010

Add a rich rule in the default zone for dropping all entries on the blacklist6:

firewall-cmd --add-rich-rule='rule source ipset=blacklist6 drop'