title: IPTables do not block IP with ipset immediately
body: <p>I have the following <code>IPTables</code> with <code>IPSet</code> as rule source to block attacking <code>IP</code>, but when I add an attacking <code>IP</code> to <code>IPSet</code>, in my <code>nginx</code> access log, I still see continuous access of the attack <code>IP</code>. After a while，maybe 3~5 minutes, the <code>IP</code> was blocked. </p>
  
  <p><strong>iptables</strong></p>
  
  <pre><code>~$ sudo iptables -nvL --line-numbers
  Chain INPUT (policy ACCEPT 317K packets, 230M bytes)
  num   pkts bytes target     prot opt in     out     source               destination
  1     106K 6004K DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            match-set Blacklist src
  
  Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
  num   pkts bytes target     prot opt in     out     source               destination
  1        0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            match-set Blacklist src
  
  Chain OUTPUT (policy ACCEPT 350K packets, 58M bytes)
  num   pkts bytes target     prot opt in     out     source               destination
  </code></pre>
  
  <p><strong>ipset</strong></p>
  
  <pre><code>sudo ipset -L
  Name: Blacklist
  Type: hash:ip
  Revision: 4
  Header: family inet hashsize 1024 maxelem 65536 timeout 60
  Size in memory: 13280
  References: 2
  Members:
  xxx.xxx.xxx.xxx(attacker ip) timeout 0
  </code></pre>
  
  <p>I don't know why the rule has not effect immediately, which make me crazy just like the attacker is laughing at me.</p>
  
  <p>I add <code>ipset</code> to the <code>iptables</code> rule with <code>-I</code> option which should keep the rule at the first position. So maybe the <code>Chain INPUT(policy Accept)</code> do the trick?</p>
  
  <p>Please help me out, thanks so much.</p>
  
  <p><strong>BTW.</strong> </p>
  
  <p>I use <code>Nginx+Djano/uWSGI</code> to deploy my application, and I use shell script to analyze nginx log to put evil ip to <code>Blacklist ipset</code>.</p>