Update a blocklist

If you only want to add or remove elements from a named set, you don’t need to replace the whole chain: use bfcli chain update-set. The update is atomic, and the chain’s counters are preserved.

From here on, we assume you created the block_sources chain and its blocklist set from Block traffic from selected addresses.

Add or remove addresses

Add two addresses to the blocklist:

$ sudo bfcli chain update-set --name block_sources --set-name blocklist \
    --add 192.0.2.3 --add 192.0.2.4
info   : updated set 'blocklist' in chain 'block_sources'

Remove an address:

$ sudo bfcli chain update-set --name block_sources --set-name blocklist \
    --remove 192.0.2.1
info   : updated set 'blocklist' in chain 'block_sources'

You can also add and remove addresses with a single command:

$ sudo bfcli chain update-set --name block_sources --set-name blocklist \
    --add 192.0.2.5 --remove 192.0.2.2
info   : updated set 'blocklist' in chain 'block_sources'

Check the content of the set

$ sudo bfcli chain get --name block_sources
chain block_sources BF_HOOK_TC_INGRESS{ifindex=2} ACCEPT
    counters policy 0 packets 0 bytes; error 0 packets 0 bytes
    set blocklist (ip4.saddr) in {
        192.0.2.3
        192.0.2.4
        192.0.2.5
    }
    rule
        (ip4.saddr) in blocklist
        counters 0 packets 0 bytes
        DROP

The set should contain the addresses you expect. If you want to be sure, send some traffic from an address you added, and from one you removed.

If your set is large, printing every element makes the output unreadable. Use --no-set-content to only print the number of elements it contains:

$ sudo bfcli chain get --name block_sources --no-set-content
chain block_sources BF_HOOK_TC_INGRESS{ifindex=2} ACCEPT
    counters policy 0 packets 0 bytes; error 0 packets 0 bytes
    set blocklist (ip4.saddr) in { /* 3 elements, content elided */ }
    rule
        (ip4.saddr) in blocklist
        counters 0 packets 0 bytes
        DROP

A set can grow as much as needed through update-set. If you know how many elements it will contain, you can reserve room for them when you define the set, using min-size (see Sets). Anonymous sets can’t be updated this way, as they have no name: use Update a chain without interrupting filtering to replace their chain instead.