In iptables-extensions(8) the set module is described and it is discussed that it is possible to react to the presence or absence of an IP or more generally a match against an IP set.However, it does not seem that there is a way to append items to an IP set on the fly using an iptables rule.The idea being that if I use the recent module, I could then temporarily blacklist certain IPs that keep trying and add them into an IP set (which is likely faster). This would mean less rules to traverse for such cases and matching against an IP set is said to be faster as well.
Can iptables rules manipulate IP sets?
linux;iptables;firewall;ipset
Turns out it is possible, using the SET target described in iptables-extensions(8).SET   This module adds and/or deletes entries from IP sets which can be defined by ipset(8).   --add-set setname flag[,flag...]          add the address(es)/port(s) of the packet to the set   --del-set setname flag[,flag...]          delete the address(es)/port(s) of the packet from the set          where flag(s) are src and/or dst specifications and there can be no more          than six of them.   --timeout value          when adding an entry, the timeout value to use instead of the default one          from the set definition   --exist          when  adding  an  entry  if it already exists, reset the timeout value to          the specified one or to the default from the set definition   Use of -j SET requires that ipset kernel support is provided, which, for standard   kernels, is the case since Linux 2.6.39.I hadn't found it, because I hadn't searched further down after finding the set module description.