Defines a set named blacklist of type hash:ip, an efficient lookup table for IP addresses. The timeout 3600 makes every entry expire after one hour unless refreshed. ipset sets live in the kernel and plug into iptables matches like -m set --match-set blacklist src.
Looking for more? Search all 7,657 commands — works offline, in English or Spanish, and fixes typos.