I've used several of these for years in conjunction with<p><pre><code> ip route add blackhole "${ip}"
</code></pre>
Blocking via route uses less CPU and memory than iptables+iplist hashes, but iplist hashes can be useful if you want to track what is being blocked. If using iptables, be sure to block in the raw table to avoid connection tracking table CPU hits.