ipset

Create an empty IP set

$ ipset create [set_name] hash:ip

$ ipset add [set_name] [192.168.1.25]

$ ipset del [set_name] [192.168.1.25]

$ ipset destroy [set_name]

$ ipset save [set_name] > [path/to/ip_set]

$ ipset list

ipset command [options]

ipset creates and manages IP sets, which are framework for storing IP addresses, networks, ports, and combinations thereof. Sets can be referenced in iptables/nftables rules for efficient matching against large lists.
Different set types support different entry formats: hash:ip for individual addresses, hash:net for CIDR ranges, hash:ip,port for address-port combinations. Sets use hash tables for O(1) lookup performance.

create NAME TYPE

Create a new IP set (types: hash:ip, hash:net, hash:ip,port, etc.)

Add entry to a set

Remove entry from a set

Delete a set

List set contents

Output sets in restorable format

Restore sets from saved output

Clear all entries from a set

Requires root privileges. Sets must be created before they can be referenced in firewall rules. Set contents are not persistent across reboots without explicit save/restore.

ipset was developed by Jozsef Kadlecsik to provide efficient set-based matching for the Linux firewall. It became part of the standard Linux networking toolkit and is widely used for implementing blocklists and allowlists.

iptables(8), nft(8), firewalld(1)