# firewalld
# ipset
firewall-cmd --permanent --new-ipset=chinablock --type=hash:ip
more /etc/firewalld/ipsets/sshblock.xml
firewall-cmd --permanent --ipset=chinablock --add-entries-from-file=./cn.zone
firewall-cmd --permanent --add-rich-rule="rule family=ipv4 source address=192.168.0.0/24 port protocol=tcp port=8080 accept"
firewall-cmd --permanent --new-ipset=chinablock --type=hash:net --option=family=inet --option=hashsize=4096 --option=maxelem=200000
firewall-cmd --permanent --add-rich-rule="rule family=ipv4 source ipset="chinablock" port protocol=tcp port=3000 accept"
firewall-cmd --permanent --remove-rich-rule="rule family=ipv4 source ipset="chinablock" port port=22 protocol=tcp accept"
firewall-cmd --permanent --add-rich-rule 'rule family="ipv4" source ipset="sshblock" drop'
firewall-cmd --zone=work --add-service=smtp
firewall-cmd --reload