#-A ufw-before-input -p tcp --dport  80 -m set --match-set block_ips src -j DROP

# 创建ipset集合
ipset create block_ips hash:ip hashsize 4096 maxelem 100000

# 删除ipset集合
ufw disable
ipset destroy block_ips

# 添加/删除关联ip
ipset list block_ips
ipset add block_ips 14.29.182.126
ipset del block_ips 14.29.182.126

持久化 ufw配置

# ipset list block_ips >/dev/null 2>&1
# if [ $? -ne 0 ]; then
#     ipset create block_ips hash:ip hashsize 4096 maxelem 100000
# fi

# 删除旧规则（避免重复添加）
# iptables -D ufw-before-input -m set --match-set block_ips src -j DROP 2>/dev/null

# 添加新规则
# iptables -I ufw-before-input -m set --match-set block_ips src -j DROP

iptables -A ... 或 iptables -I ... 手动添加规则，只要执行 ufw reload、systemctl restart ufw 或重启系统，这些手动添加的 iptables 规则就会立刻被清空或覆盖。

正确的持久化做法

• 方式一：写入 UFW 的配置文件 /etc/ufw/before.rules
• 方式二：安装 iptables-persistent，手动添加完 iptables 命令后，使用netfilter-persistent save 保存当前内存中的规则

下面使用方式一

如果黑名单里的 IP 已经建立连接，它可能会被 ESTABLISHED 规则放行。若要立刻断开已建立的恶连接，就把 -m set --match-set block_ips src -j DROP 放在 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT 的上方

vim /etc/ufw/before.rules

# Don't delete these required lines, otherwise there will be errors
*filter
:ufw-before-input - [0:0]
:ufw-before-output - [0:0]
:ufw-before-forward - [0:0]
:ufw-not-local - [0:0]
# End required lines

# allow all on loopback
-A ufw-before-input -i lo -j ACCEPT
-A ufw-before-output -o lo -j ACCEPT

# Block traffic from banned IP addresses
-A ufw-before-input -m set --match-set block_ips src -j DROP

# quickly process packets for which we already have a connection
-A ufw-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A ufw-before-output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A ufw-before-forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
...
# don't delete the 'COMMIT' line or these rules won't be processed
COMMIT

解决服务器重启 ufw 启动失败，因ipset block_ips 未创建，导致无法连接外网

Dec 02 11:07:30 proxy51 ufw-init[594]: iptables-restore v1.6.1: Set block_ips doesn't exist.
Dec 02 11:07:30 proxy51 ufw-init[594]: Error occurred at line: 79
Dec 02 11:07:30 proxy51 ufw-init[594]: Try `iptables-restore -h' or 'iptables-restore --help' for more information.
Dec 02 11:07:30 proxy51 systemd[1]: ufw.service: Main process exited, code=exited, status=1/FAILURE
Dec 02 11:07:30 proxy51 ufw-init[594]: Problem running '/etc/ufw/before.rules'
Dec 02 11:07:30 proxy51 systemd[1]: ufw.service: Failed with result 'exit-code'.

# /usr/local/bin/ipset-init.sh
#!/bin/bash

SET_NAME="block_ips"
RULE_FILE="/etc/ipset.rules"

# 1. 创建 ipset 集合（如果不存在则创建，已存在则忽略）
ipset create "$SET_NAME" hash:ip hashsize 4096 maxelem 100000 -exist

# 2. 检查文件是否存在且非空 (-s 表示文件存在且大小大于 0)
if [[ -s "$RULE_FILE" ]]; then
    ipset restore -exist -f "$RULE_FILE"
    echo "已成功导入 ipset 规则：$RULE_FILE"
else
    echo "提示: 规则文件 '$RULE_FILE' 不存在或为空，已跳过导入。"
fi

chmod +x /usr/local/bin/ipset-init.sh

# /etc/systemd/system/ipset-init.service
[Unit]
Description=Initialize ipset rules
Before=ufw.service
Wants=ufw.service

[Service]
Type=oneshot
ExecStart=/usr/local/bin/ipset-init.sh
RemainAfterExit=true

[Install]
WantedBy=multi-user.target

systemctl enable ipset-init