Create ipset-blacklist.service

[marcolinuz]

Hello, this is a simple systemd service configuration file to automatically activate the blacklist at system reboot.
It can be also used to start and stop the blacklist on demand with the commands:
systemctl start ipset-blacklist and systemctl stop ipset-blacklist

All you need to do to activate the service is to put this file on your /etc/systemd/system directory and run the command: systemctl enable ipset-blacklist.service

Best Reguards.

[Siggemada]

This unit file needs to be started before netfilter-persistent.

[Unit]
Description=Enable IP Blacklist firewall blocking on System Startup
#After=network.target lxc.service
Before=network-pre.target netfilter-persistent.service
Wants=network-pre.target
Documentation=man:ipset man:iptables
[Service]
Type=oneshot
RemainAfterExit=yes
WorkingDirectory=/etc/ipset-blacklist
ExecStartPre=/sbin/ipset restore -f /etc/ipset-blacklist/ip-blacklist.restore
ExecStart=/sbin/iptables -I INPUT 1 -m set --match-set blacklist src -j DROP
ExecStop=/sbin/iptables -D INPUT 1 -m set --match-set blacklist src
ExecStopPost=/sbin/ipset destroy blacklist
Delegate=yes
StandardOutput=syslog
StandardError=syslog
[Install]
WantedBy=multi-user.target

[AcckiyGerman]

You could also add auto-update routine every 24h