{"id":97,"date":"2018-10-19T09:37:50","date_gmt":"2018-10-19T01:37:50","guid":{"rendered":"http:\/\/www.nickyoo7.pro\/?p=97"},"modified":"2018-10-19T09:37:50","modified_gmt":"2018-10-19T01:37:50","slug":"%e5%88%a9%e7%94%a8-iptable-ipset-%e5%b0%81%e9%8e%96%e5%a4%a7%e9%87%8f-ip","status":"publish","type":"post","link":"https:\/\/www.nickyoo7.com\/?p=97","title":{"rendered":"\u5229\u7528 iptable + ipset \u5c01\u9396\u5927\u91cf IP"},"content":{"rendered":"<p>\u5229\u7528 iptable + ipset \u5c01\u9396\u5927\u91cf IP<!--more--><\/p>\n<p>\u5b89\u88dd ipset<\/p>\n<pre class=\"lang:sh decode:true \">yum install ipset<\/pre>\n<p>\u65b0\u589e\u898f\u5247\u914d\u5b9c\u7f6e\u6a94 : block_ip =&gt; \u4ee5 ip \u578b\u5f0f\u7684\u9ed1\u540d\u55ae<\/p>\n<pre class=\"lang:sh decode:true \">ipset create block_ip hash:ip hashsize 4096<\/pre>\n<p>\u8aaa\u660e : hash:ip \u5373\u662f\u8a2d\u5b9a\u70ba ip \u578b\u5f0f<\/p>\n<p>\u65b0\u589e\u898f\u5247\u914d\u5b9c\u7f6e\u6a94 : block_net =&gt; \u4ee5 net \u578b\u5f0f\u7684\u9ed1\u540d\u55ae<\/p>\n<pre class=\"lang:sh decode:true \">ipset create block_net hash:net hashsize 4096<\/pre>\n<p>\u8aaa\u660e : hash:net \u5373\u662f\u8a2d\u5b9a\u70ba net \u578b\u5f0f<\/p>\n<p>\u65b0\u589e ip \u5230\u6e05\u55ae<\/p>\n<pre class=\"lang:sh decode:true \">ipset add block_ip 172.245.110.180<\/pre>\n<p>\u65b0\u589e\u4e00\u7db2\u6bb5\u5230\u6e05\u55ae<\/p>\n<pre class=\"lang:sh decode:true \">ipset add block_net 191.96.249.0\/24<\/pre>\n<p>\u65b0\u589e\u5728 iptable \u898f\u5247<\/p>\n<pre class=\"lang:sh decode:true\">iptables -I INPUT -m set --match-set block_ip src -j DROP\r\niptables -I INPUT -m set --match-set block_net src -j DROP<\/pre>\n<p>\u5982\u679c\u662f\u8981\u7576\u767d\u540d\u55ae , \u5728 set \u5f8c\u52a0\u4e00\u500b ! \u5373\u53ef.<\/p>\n<pre class=\"lang:sh decode:true \">iptables -I INPUT -m set ! --match-set white_net src -j DROP<\/pre>\n<p>ipset \u8aaa\u660e :<\/p>\n<p>1.\u5efa\u7acb\u4e00\u500b\u914d\u7f6e\u6a94<\/p>\n<pre class=\"lang:default decode:true\">ipset create \u540d\u55ae hash:\u578b\u614b,Port maxelem 1000000<\/pre>\n<p>\u578b\u614b :\u00a0 ip \u548c net<br \/>\nPort : \u6307\u5b9a\u7684 Port (\u53ef\u7701\u7565) \u524d\u9762\u9700\u52a0\u9017\u865f \u3010,\u3011<br \/>\nmaxelem :\u00a0\u9810\u8a2d\u53ef\u4ee5\u5132\u5b5865536\u500b\u5143\u7d20\uff0c\u4f7f\u7528maxelem\u6307\u5b9a\u6578\u91cf(\u53ef\u7701\u7565)<\/p>\n<p>2.\u6aa2\u8996\u5df2\u5efa\u7acb\u7684 ipset<\/p>\n<pre class=\"lang:sh decode:true\">ipset list\r\nipset list \u540d\u55ae<\/pre>\n<p>3.\u52a0\u5165\u540d\u55ae\u5167<\/p>\n<pre class=\"lang:default decode:true \">ipset add \u540d\u55ae ip(net)<\/pre>\n<p>3.\u5f9e\u540d\u55ae\u79fb\u9664<\/p>\n<pre class=\"lang:sh decode:true \">ipset del \u540d\u55ae ip(net)<\/pre>\n<p>4.\u5c07ipset \u540d\u55ae\u5132\u5b58\u5230\u6587\u4ef6<\/p>\n<pre class=\"lang:sh decode:true \">ipset save \u540d\u55ae -f  \u6a94\u540d.txt<\/pre>\n<p>5.<strong>\u522a\u9664 ipset \u898f\u5247\u540d\u55ae<br \/>\n<\/strong><\/p>\n<pre class=\"lang:sh decode:true\">ipset destroy          #\u522a\u9664\u6240\u6709\u540d\u55ae\r\nipset destroy \u540d\u55ae     #\u522a\u9664\u55ae\u4e00\u540d\u55ae<\/pre>\n<p>6.<strong>\u532f\u5165 ipset \u898f\u5247<br \/>\n<\/strong><\/p>\n<pre class=\"lang:sh decode:true \">ipset restore -f \u6a94\u540d.txt<\/pre>\n<p>7.\u81ea\u52d5\u904e\u671f<\/p>\n<pre class=\"lang:sh decode:true\">ipset add \u540d\u55ae ip timeout 100<\/pre>\n<p>8.\u91cd\u65b0\u6307\u5b9a\u5230\u671f\u6642\u9593 , \u9700\u52a0\u00a0-exist<\/p>\n<pre class=\"lang:sh decode:true \">ipset -exist add \u540d\u55ae ip timeout 100<\/pre>\n<p>9.\u6e05\u7a7a\u898f\u5247<\/p>\n<pre class=\"lang:default decode:true \">ipset flush           #\u6e05\u7a7a\u6240\u6709\u540d\u55ae\r\nipset flush \u540d\u55ae      #\u6e05\u7a7a\u55ae\u4e00\u540d\u55ae<\/pre>\n<p>\u53c3\u8003\u8cc7\u6599 :<br \/>\n<a href=\"https:\/\/fixatom.com\/block-ip-with-ipset\/\" target=\"_blank\" rel=\"noopener\">https:\/\/fixatom.com\/block-ip-with-ipset\/<\/a><br \/>\n<a href=\"https:\/\/tw.saowen.com\/a\/e1dbc5e061b224c07fffc36ba1ea16861f3a6116dfd2d8ef82e0a07aacde8509\" target=\"_blank\" rel=\"noopener\">https:\/\/tw.saowen.com\/a\/e1dbc5e061b224c07fffc36ba1ea16861f3a6116dfd2d8ef82e0a07aacde8509<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u5229\u7528 iptable + ipset \u5c01\u9396\u5927\u91cf IP<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-97","post","type-post","status-publish","format-standard","hentry","category-linux-","entry"],"_links":{"self":[{"href":"https:\/\/www.nickyoo7.com\/index.php?rest_route=\/wp\/v2\/posts\/97","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.nickyoo7.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.nickyoo7.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.nickyoo7.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.nickyoo7.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=97"}],"version-history":[{"count":1,"href":"https:\/\/www.nickyoo7.com\/index.php?rest_route=\/wp\/v2\/posts\/97\/revisions"}],"predecessor-version":[{"id":98,"href":"https:\/\/www.nickyoo7.com\/index.php?rest_route=\/wp\/v2\/posts\/97\/revisions\/98"}],"wp:attachment":[{"href":"https:\/\/www.nickyoo7.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=97"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.nickyoo7.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=97"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.nickyoo7.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=97"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}