Linux 网络设置工具 IP sets

Linux 网络设置工具 IP sets

IP sets are a framework inside the Linux 2.4.x and 2.6.x kernel, which can be administered by the ipset utility.

Depending on the type, currently an IP set may store IP addresses, (TCP/UDP) port numbers or IP addresses with MAC addresses in a way, which ensures lightning speed when matching an entry against a set.

Unordered list of some tips and examples:


  • In order to drop traffic to-from banned networks or IP addresses, use IP sets in the raw table of netfilter.
  • If you want to change a set without disturbing your existing iptables rules, simply swap it with the new set:
    # Create the new set and add the entries to it
    ipset -N new-set ....
    ipset -A new-set ....
    # Swap the old and new sets
    ipset -W old-set new-set
    # Get rid of the old set, which is now under new-set
    ipset -X new-set



  • store multiple IP addresses or port numbers and match against the collection by iptables at one swoop;
  • dynamically update iptables rules against IP addresses or ports without performance penalty;
  • express complex IP address and ports based rulesets with one single iptables rule and benefit from the speed of IP sets


In order to use IP sets, you need the following sources

You can download the source of ipset from git as well: git://

Please note, the ipset source supports kernels released by It may or may not work on distribution-specific kernel sources.

Read the ipset and iptables man pages before exploring the world of IP sets.