Over the weekend I got attacked. I realized the cause of this was because I rebooted my server and the docker IPTables rules overwrote the IPTables-Persistent rules I had. After realizing this was the case I uninstalled docker since I wasn’t using it and while I was making firewall changes I set up ipset to block most foreign countries. I also removed IPTables-Persistent and instead just added the post up to the /etc/network/interfaces
post-up ipset restore < /etc/iptables/ipset.save
post-up iptables-restore < /etc/iptables/rules.v4
After I found this out I did some research and it’s already known. Here are links on how to make things work.