Kangle配合ipset打造黑名单系统、自动封禁IP

# centos
yum install ipset iptables

# Debian
apt install ipset iptables

ipset create kangle hash:ip hashsize 4096 maxelem 1000000
# 加入系统自启动
echo "/usr/sbin/ipset create kangle hash:ip hashsize 4096 maxelem 1000000" >> /etc/rc.d/rc.local

iptables -I INPUT -m set --match-set kangle src -p tcp -m multiport --destination-port 80,81,443,3312,3313 -j DROP
service iptables save
service iptables restart

touch /vhs/kangle/ext/ipset.xml;
cat >>/vhs/kangle/ext/ipset.xml<<EOF
<!--#start 800 -->
<?xml version="1.0" encoding="utf-8"?>
<config>
<block_ip_cmd>/usr/sbin/ipset add kangle ${ip}</block_ip_cmd>
<unblock_ip_cmd>/usr/sbin/ipset del kangle ${ip}</unblock_ip_cmd>
<flush_ip_cmd>/usr/sbin/ipset flush kangle</flush_ip_cmd>
</config>
EOF

/vhs/kangle/bin/kangle -r

ipset list kangle

rm -f /vhs/kangle/ext/ipset.xml
/vhs/kangle/bin/kangle --r
ipset flush