I saw you are already implementing some ideas from my inputs, that is great, please keep it going.
Eventually, in notorious systems, you may face issues of having too many /32 rules, a good idea is to implement some mechanism to defragment them into single/bigger contiguous cidr blocks. There are other firewall implementations that can serve as inspiration.
OR
I recommend using ipset with a single iptables rule to match/block from the set. This way you don't need to reload stuff everytime. (Just add the ips into the set)
PS: I hope you don't mind my snark comments, HN is fun.
I saw you are already implementing some ideas from my inputs, that is great, please keep it going.
Eventually, in notorious systems, you may face issues of having too many /32 rules, a good idea is to implement some mechanism to defragment them into single/bigger contiguous cidr blocks. There are other firewall implementations that can serve as inspiration.
OR
I recommend using ipset with a single iptables rule to match/block from the set. This way you don't need to reload stuff everytime. (Just add the ips into the set)
PS: I hope you don't mind my snark comments, HN is fun.