All About IPSet: From Basics to Advanced Configuration

What is IPSet?

IPSet is a super handy tool used with the iptables firewall on Linux systems. It lets you create and manage sets of IP addresses, which you can then use to create more efficient and scalable firewall rules. Here’s a quick rundown:

• Efficiency: IP sets are stored in indexed data structures, making lookups very fast, even with large sets of IP addresses.
• Flexibility: You can create sets of IP addresses, network addresses, port numbers, and even IP and MAC address pairs.
• Integration with iptables: Use IP sets in iptables rules to match entire sets of addresses at once.
• Persistence: Save and restore IP sets to ensure configurations persist across reboots.
• Use Cases: Blocking malicious IPs, whitelisting trusted IPs, geo-blocking, rate limiting, dynamic IP management, load balancing, and VPN management.

Common Use Cases for IPSet

1. Blocking Malicious IPs: Create a set of known malicious IP addresses and block them with a single iptables rule.
2. Whitelisting Trusted IPs: Allow access to certain services or parts of your network from trusted IP addresses.
3. Geo-blocking: Block or allow traffic based on geographic location using IP ranges from specific countries.
4. Rate Limiting: Manage rate limiting by creating sets of IPs that exceed certain request thresholds.
5. Dynamic IP Management: Efficiently manage frequently changing IP addresses, such as those in cloud services.
6. Load Balancing: Distribute traffic across multiple servers by maintaining sets of server IPs.
7. VPN Management: Manage VPN connections by maintaining sets of IPs that are allowed or denied access.

Does IPSet Use a Database?

Nope, IPSet doesn’t use a traditional database. Instead, it uses in-memory data structures within the Linux kernel to store and manage sets of IP addresses, networks, and ports. These structures are designed for efficient lookups and modifications.

How Many IPs Can IPSet Handle?

IPSet can handle a very large number of IP addresses efficiently, typically up to 67,108,864 IP addresses. This high capacity is due to the efficient in-memory data structures used by IPSet.

Configuring IPSet for Large Sets

Here’s how to set up IPSet to handle large sets of IP addresses:

1. Install IPSet: sudo apt-get install ipset
2. Create an IP Set: sudo ipset create myset hash:ip hashsize 4096 maxelem 1000000
   • hash:ip specifies the type of set.
   • hashsize sets the initial size of the hash table.
   • maxelem sets the maximum number of elements the set can hold.
3. Add IP Addresses to the Set: sudo ipset add myset 192.168.1.1 sudo ipset add myset 192.168.1.2 For bulk additions, use a file: sudo ipset restore < myset.conf
4. Integrate with iptables: sudo iptables -A INPUT -m set --match-set myset src -j DROP
5. Save and Restore IP Sets: sudo ipset save > /etc/ipset.conf sudo ipset restore < /etc/ipset.conf

By following these steps, you can efficiently manage large sets of IP addresses with IPSet, keeping your firewall rules fast and scalable.