Linux firewall (ipset, nftables)

Drop listed addresses in the kernel with ipset and iptables, or nftables sets.

Dropping listed addresses in the kernel is the cheapest block there is: the traffic never reaches sshd, nginx or your application. Pick ipset with iptables, or native nftables sets.

ipset and iptables

1. Load the list. The ipset format creates the sets on first run and replaces their contents on every later run:

   curl -sf "https://isipsafe.com/api/v1/blocklist?key=$ISIPSAFE_KEY&format=ipset" | sudo ipset restore -exist

2. Drop matching traffic (once):

   sudo iptables  -I INPUT -m set --match-set isipsafe  src -j DROP
   sudo ip6tables -I INPUT -m set --match-set isipsafe6 src -j DROP

3. Refresh hourly from root's crontab:

   0 * * * * curl -sf "https://isipsafe.com/api/v1/blocklist?key=sl_your_key_here&format=ipset" | /usr/sbin/ipset restore -exist

Rules and sets do not survive a reboot by themselves. Use iptables-persistent / netfilter-persistent, or rerun step 1 and 2 from a boot script.

nftables

1. Create the sets and drop rules (once, or in /etc/nftables.conf):

   sudo nft add table inet filter
   sudo nft add set inet filter isipsafe4 '{ type ipv4_addr; flags interval; }'
   sudo nft add set inet filter isipsafe6 '{ type ipv6_addr; flags interval; }'
   sudo nft add rule inet filter input ip saddr @isipsafe4 drop
   sudo nft add rule inet filter input ip6 saddr @isipsafe6 drop

   If you already have an inet filter table with an input chain, skip the first line and add the rules to your chain.
2. Load and refresh the list hourly:

   curl -sf "https://isipsafe.com/api/v1/blocklist?key=$ISIPSAFE_KEY&format=nftables" | sudo nft -f -

Choosing a threshold

The default confidenceMinimum=75 suits most servers. Add &confidenceMinimum=90 to be more careful, or filter by country with &exceptCountries=GB,IE. Never block your own management addresses: put them in an allowlist rule above the drop.

Need a hand?

If something here does not work with your version of Linux firewall (ipset, nftables), or you have improved it, tell us. We update these pages with what people send.

Linux firewall (ipset, nftables) and its logo are trademarks of their respective owners. isipsafe is not affiliated with or endorsed by them.