We use the set module of iptables to enable references to ipset. If package’s source ip belong to hash table test, then drop it. :~$ iptables -I INPUT -match set -match-set test src -jump DROP Then ipset may be the proper tool for you. express complex IP address and ports based rulesets with one single iptables rule and benefit from the speed of IP sets.dynamically update iptables rules against IP addresses or ports without performance penalty.store multiple IP addresses or port numbers and match against the collection by iptables at one swoop.Depending on the type, an IP set may store IP addresses, networks, (TCP/UDP) port numbers, MAC addresses, interface names or combinations of them in a way, which ensures lightning speed when matching an entry against a set. IP sets are a framework inside the Linux kernel, which can be administered by the ipset utility. Sometimes it may be necessary to block tens of thousands of IPs, adding tens of thousands of rules will greatly affect the performance of the server. When dealing with network attacks, using iptables to block IP is a common and simple way.

Ipset linux