firewall-cmd通过rich-rule和ipset封IP

单独封222.222.222.222/24

firewall-cmd --permanent --zone=public --add-rich-rule 'rule family="ipv4" source address="222.222.222.222/24" drop'
firewall-cmd --reload

解封222.222.222.222/24

firewall-cmd --permanent --zone=public --remove-rich-rule 'rule family="ipv4" source address="222.222.222.222/24" drop'
firewall-cmd --reload

只用rich-rule封一两条还行，封多了操作麻烦。下面结合ipset来封
1.创建一个blacklist

firewall-cmd --permanent --zone=public --new-ipset=blacklist --type=hash:net
firewall-cmd --reload

2.添加IP到blasklist

firewall-cmd --permanent --zone=public --ipset=blacklist --add-entry=222.222.222.222/24

3.把blacklist用rich-rule封掉

firewall-cmd --permanent --zone=public --add-rich-rule='rule source ipset=blacklist drop'
firewall-cmd --reload
firewall-cmd --list-all
firewall-cmd --info-ipset=blacklist

根据IP放行同理，把drop换成accept即可