When you execute iptables commands, the rules are applied immediately at the kernel level. There's no inherent delay in the Linux networking stack for basic rule application. Your script:

#!/bin/sh
echo $1 >> /etc/dropped_hosts
iptables -A INPUT -s $1 -j DROP
iptables -A OUTPUT -d $1 -j DROP

is fundamentally correct for adding blocking rules. The -A flag appends rules to the end of the chain, which takes effect the moment the command completes.

If rules don't appear to work immediately, consider these factors:

• Existing Connections: Established TCP connections may persist until timeout
• DNS Caching: If blocking by hostname rather than IP
• Rule Position: Earlier ACCEPT rules might take precedence
• Network Stack Timing: Packet processing in flight during rule application

Use these diagnostic commands to confirm:

# Check if rules exist
iptables -L -n -v | grep $IP

# Monitor packet counters
watch -n1 iptables -L -n -v

# Check connection tracking
conntrack -L | grep $IP

Here's an enhanced version that includes verification:

#!/bin/bash
TARGET=$1

# Validate IP format
if [[ ! $TARGET =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
    echo "Error: Invalid IP format" >&2
    exit 1
fi

# Add blocking rules
iptables -A INPUT -s $TARGET -j DROP
iptables -A OUTPUT -d $TARGET -j DROP

# Verify
if iptables -C INPUT -s $TARGET -j DROP 2>/dev/null; then
    echo "$TARGET blocked successfully"
    echo "$TARGET $(date)" >> /etc/dropped_hosts
else
    echo "Blocking failed for $TARGET" >&2
fi

For critical systems, consider these techniques:

# Insert rules at the beginning for immediate effect
iptables -I INPUT 1 -s $IP -j DROP

# Flush conntrack for existing connections
conntrack -D -s $IP

# Use ipset for large blocklists
ipset create blocked_hosts hash:ip
ipset add blocked_hosts $IP
iptables -A INPUT -m set --match-set blocked_hosts src -j DROP

Remember that iptables rules are volatile by default. For persistence across reboots, use iptables-save and your distribution's method for restoring rules.

When you execute an iptables command like iptables -A INPUT -s $1 -j DROP, the rule is applied immediately at the kernel level. There's no inherent delay in the firewall subsystem. The Linux kernel processes these rules synchronously during packet filtering.

If you're observing what appears to be a delay in rule application, consider these technical factors:

# Check current connections that might bypass new rules
netstat -tulnp | grep $IP_ADDRESS
conntrack -L | grep $IP_ADDRESS

Existing connections in the conntrack table may continue even after adding DROP rules. To immediately terminate existing connections:

# Flush conntrack entries for the blocked IP
conntrack -D --orig-src $1
conntrack -D --orig-dst $1

Here's an improved version of your blocking script that handles connection tracking:

#!/bin/bash
TARGET_IP=$1

# Validate IP format
if [[ ! $TARGET_IP =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
    echo "Invalid IP format"
    exit 1
fi

# Add to blocklist
echo "$TARGET_IP $(date)" >> /etc/dropped_hosts

# Apply firewall rules
iptables -A INPUT -s $TARGET_IP -j DROP
iptables -A OUTPUT -d $TARGET_IP -j DROP

# Clear existing connections
if command -v conntrack &> /dev/null; then
    conntrack -D --orig-src $TARGET_IP
    conntrack -D --orig-dst $TARGET_IP
fi

# Verify rules
iptables -L -n | grep $TARGET_IP

To confirm your rules are working:

# Check if packets are being dropped
iptables -L -v -n

# Real-time monitoring
tcpdump -ni eth0 host $TARGET_IP

# Test connectivity
timeout 1 ping -c 1 $TARGET_IP

For high-traffic systems, consider these optimizations:

• Place frequently matched rules higher in the chain
• Use ipset for large blocklists
• Consider nftables for modern systems

# Example using ipset
ipset create blocked_hosts hash:ip
ipset add blocked_hosts $TARGET_IP
iptables -I INPUT -m set --match-set blocked_hosts src -j DROP