first, you wanna make ipsets these accelerate the performance a lotfirewall-cmd --permanent --new-ipset=denylist --type=hash:ip --family=inet
firewall-cmd --permanent --new-ipset=denylist6 --type=hash:ip --family=inet6Sadly, dual stack isn't a thing so we make both. You can add a description/short if you'd like. Then you add entries:firewall-cmd --ipset=denylist --add-entry=1.2.3.4 --permanent
firewall-cmd --ipset=denylist6 --add-entry=dead:beef::1/48 --permanentNote that CIDR nets are fine too here! Though I'm hazy on the specifics. Finally, we need to actually DROP the traffic... so let's just add it to the drop zone:firewall-cmd --permanent --zone=drop --add-source=ipset:denylist
firewall-cmd --permanent --zone=drop --add-source=ipset:denylist6And then we reload the config: firewall-cmd --reload. And now the traffic from the addresses is dropped.
Hi, I'm Tosti.This is my main account.My public account is @toast and my private is @tosti.Follow requests approved based on feels.If you cause a ruckus, I will block you unapologetically - I'm here to be comfy.gay/ace :heartace: :hearttrans:retired occultistI got really sick in September 2021. I'm a lot better nowadays, but a ways off from a full recovery. Be gentle!