韩爱东 <yywfqq@xxxxxxxxxx> wrote: > so , is there a method to resolved this problem? Is iptables has a rules mark function，that can delete all marked rules? > thanks. Yes, use ipset and add the ips to the ipset instead. Then you never need to remove the rule: -A INPUT -p tcp --dport 5943 -m ipset --match-set whitelist src -j ACCEPT Just add timeout option: ipset create whitelist hash:ip timeout 300 ipset add whitelist 10.1.1.1 timeout 3600 the entry will disappear automatically after one hour. Or use nftables, it also supports sets with timeouts. -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
