Conversation

first, you wanna make ipsets
these accelerate the performance a lotfirewall-cmd --permanent --new-ipset=denylist --type=hash:ip --family=inet firewall-cmd --permanent --new-ipset=denylist6 --type=hash:ip --family=inet6Sadly, dual stack isn't a thing so we make both.
You can add a description/short if you'd like.
Then you add entries:firewall-cmd --ipset=denylist --add-entry=1.2.3.4 --permanent firewall-cmd --ipset=denylist6 --add-entry=dead:beef::1/48 --permanentNote that CIDR nets are fine too here! Though I'm hazy on the specifics.
Finally, we need to actually DROP the traffic... so let's just add it to the drop zone:firewall-cmd --permanent --zone=drop --add-source=ipset:denylist firewall-cmd --permanent --zone=drop --add-source=ipset:denylist6And then we reload the config: firewall-cmd --reload.
And now the traffic from the addresses is dropped.