"The question is: How can I list the blocked IP addresses?"
Create a BANNED chain:
iptables -N BANNED
iptables -F BANNED
Create a logging chain:
iptables -N BANNEDLOG
iptables -F BANNEDLOG
iptables -A BANNEDLOG -j LOG --log-prefix "BANNED:" --log-level 6
iptables -A BANNEDLOG -j DROP
Add jump to banned chain in the INPUT chain before most other rules
iptables -A INPUT -j BANNED
Now add ipaddresses to the banned chain:
flock -w 5 /var/lock/iptables -c 'iptables -A BANNED -s 18.104.22.168/32 -i eth0 -m comment --comment "2012-03-19 23:49:33 accesslog" -j BANNEDLOG'
You can also use it like a database with the comment options, so you can know when and why etc.
flock is important when iptables is being frequently updated by many processes - it appears that iptables doesn't have any locking built in to it.
To view the banned addresses and rules in the banned chain:
iptables -S BANNED
To view just sorted unique ipaddresses:
iptables -S BANNED | egrep -o '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | sort -u
I have a number of daemons running on my servers checking the syslog files and weblogs, so if anything nasty is being attempted by anyone, their address is automatically banned for a few days, depending on type and severity and number of previous attacks. The info is logged into a mysql database, and periodically expired. The addresses are also distributed to every other machine in the cluster over mysql replication so they are also protected and keep in sync.
My software also looks up the owner of the network and mails a complaint to the ISP.
After 10 years of work, I hope to make it available for everyone to use soon.
I currently have about 1.5 million ip address histories and hundreds of thousands of mail and ssh attacks reported, helping to clean the net. If more would use it then I hope it would have more impact.