[RFE]: Startup/stop time improvement -- bulk ban/unban

Feature request type

Improve startup and stop time of fail2ban service (start / stop actions) by bulk ban / unban operations.

Description

Recently I found out that my server was slowing down because of iptables 20K rules. In digging out solutions I noticed that starting the service with my 20K bans takes around 4 HOURS on 2CPU machine. That is a bit ridicules and frustrating on rebooting. With switching to nftables it seems time reduced to 30-40 mins (didn't do thorough checks). Stopping the service is the same long, never-ending process. However, using nftables config file takes less than 1sec to load all of 20K IPs (that how I'm gonna to speed up my fail2ban now, by transferring permanent (5-10 years) bans to nftables config file).

Here the another solution for that: to do a bulk ban / unban. By this I mean instead of ban 1 IP at a time do up to 5000 bans for a jail at service start therefore you will need just couple junks for 20K records. The same goes for stop service (actually, here we can just flush (nftables flush set / iptables -F). Forgot to mention It will also reduce CPU load thus speed up servers after reboots.

Possible solution

To add variable on actionstart / actionstop invocation so we can add insert all IPs at start/stop of jail. For example for actions.d/nftables-commons.conf:

actionstart = <nftables> add set <nftables_family> <nftables_table> <set_name> \{ type <nftables_type>\; \}
              <nftables> insert rule <nftables_family> <nftables_table> <chain> %(nftables_mode)s <address_family> saddr @<set_name> <blocktype>
              #new row
              <nftables> add element <nftables_family> <nftables_table> <set_name> \{ <ips> \}

Also, skip whole unban actions on stop service as all records (a rule and a set) will be deleted/flushed with

actionstop = .....
             <nftables> delete rule <nftables_family> <nftables_table> <chain> $HANDLE_ID
             <nftables> delete set <nftables_family> <nftables_table> <set_name>

so you don't need waste time / CPU on unbaning.

Thanks for you attention.