I was wondering about the semantics of ipset(8).Is it possible to add a rule matching a set to iptables and then manipulate the set, or can I only create a set and swap it for an older set in order to apply it to an iptables rule matching the name? I.e. can I add/remove to/from an IP set ad hoc, or can I exchange whole sets while the sets are in active use?The reason I ask is this is as follows. Say I create a setipset create PCs hash:ipipset add PCs 1.1.1.1ipset add PCs 2.2.2.2... et cetera. And a rule that allows access to HTTP:iptables -A INPUT -p tcp --dport 80 -m set --set PCs src -j ACCEPTWhat happens when I run:ipset add PCs 3.3.3.3will the iptables rule now take immediate effect for IP 3.3.3.3 as well?I saw it's possible to use -j SET --add-set ... to manipulate IP sets ad hoc from within iptables rules. This makes me think it should work to manipulate a set at any given point.However, the ipset project site seems to suggest that swapping a new (adjusted) set for another is the better alternative. Be it via ipset swap or via ipset restore -!.Can anyone shed light on this?
Do I have to swap IP sets, or can I add/remove on the fly?
linux;iptables;firewall;ipset
You can add and remove IPs to your already defined sets on the fly.  This is one of the ideas behind IPsets: if this wasn't possible, the whole set extension of iptables wouldn't make much sense.The primary goal of ipset was to enable you to define (also dynamically) classes of matches (e.g. for dynamically blacklisting malicious hosts without the need to magically add one rule for every single host).excerpt from the ipset homepagestore multiple IP addresses or port numbers and match against the collection by iptables at one swoopdynamically update iptables rules against IP addresses or ports without performance penaltyexpress complex IP address and ports based rulesets with one single iptables rule and benefit from the speed of IP sets