Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I would like to use this tutorial: http://www.jsimmons.co.uk/2010/06/08/using-ipset-with-iptables-in-ubuntu-lts-1004-to-block-large-ip-ranges/

But in Ubuntu 12.04 the package ipset-source is removed from the repository, i guess that's why i get only an error when i try installing it like this:

apt-get install module-assistant ipset
m-a a-i ipset

how would i do that in Ubuntu precise?

share|improve this question

3 Answers 3

up vote 0 down vote accepted

I think you do something wrong. That article is not up to date because it's about 10.04 LTS. Now you can just issue

sudo apt-get install ipset

I've just installed ipset on my 12.04 without any problem. Take a look at my install log https://gist.github.com/3720382

share|improve this answer
    
i did that too, and there were no errors either. but don't I have to build and install the kernel module anymore? –  rubo77 Sep 14 '12 at 7:44
    
ok, there was no error installing it, just errors on that tutorial at jsimmons –  rubo77 Sep 14 '12 at 7:57
    
I found an example here manpages.ubuntu.com/manpages/precise/man8/ipset.8.html like this: ipset create foo bitmap:ip range 192.168.0.0/16; ipset add foo 192.168.1/24; ipset test foo 192.168.1.1; is that all i need to change the script on jsimmons.co.uk/2010/06/08/… ? –  rubo77 Sep 14 '12 at 7:58
    
Yes exactly this is what you need to do –  hostmaster Sep 14 '12 at 8:27
    
how would i create a group then, than can consist of thousands of ip-ranges? ipset create foo bitmap:ip range 0.0.0.0/8 ? –  rubo77 Sep 22 '12 at 2:51

Worst case scenario just download the source from Ipset and compile it manually.

wget http://ipset.netfilter.org/ipset-6.13.tar.bz2
tar xvfj ipset-6.13.tar.bz2
cd ipset-6.13
./configure
make
make check
make install

For more info check the README or INSTALL or run ./configure --help for some exotic options.

share|improve this answer
    
thx, but apt-get is just fine ;) –  rubo77 Sep 14 '12 at 9:59
    
haha that's too easy :)) –  golja Sep 15 '12 at 14:30
    
ipset has come a looong way... I remember having to compile from source. Ubuntu is getting more enjoyable, lately :) –  pepoluan Sep 10 '13 at 12:37

This is how this tutoriall at jsimmons works on Ubuntu 12.04:

sudo apt-get install ipset

# enter the countrycode that you dont want to block here (for example de for Germay):
DONTBLOCK=de

# download the zonefiles into /tmp/zones/
cd /tmp
wget http://www.ipdeny.com/ipblocks/data/countries/all-zones.tar.gz
mkdir zones
cd zones
tar -xzvf ../all-zones.tar.gz
# remove the zone you want to keep:
rm /tmp/zones/$DONTBLOCK.zone

FOLDER=/etc/zoneipblock/
mkdir $FOLDER
BLOCKLIST=$FOLDER"non_$DONTBLOCK.zone_blocklist"
cat /tmp/zones/*.zone > $BLOCKLIST

#if you want to block only the biggest blocks, use the short list:
BLOCKLIST_SHORT="$BLOCKLIST"_short
cat $BLOCKLIST |grep /8>$BLOCKLIST_SHORT
cat $BLOCKLIST |grep /9>>$BLOCKLIST_SHORT
cat $BLOCKLIST |grep /10>>$BLOCKLIST_SHORT
cat $BLOCKLIST |grep /11>>$BLOCKLIST_SHORT
cat $BLOCKLIST |grep /12>>$BLOCKLIST_SHORT

IPS=$(cat $BLOCKLIST_SHORT)

exit

#TODO: create the list with the right command
#ipset create feckof ...
ipset --create feckoff bitmap:ip range [fromip-toip|ip/cidr]

for i in $IPS; do
ipset add feckof $i
done

iptables -A INPUT -m set –set feckoff src -j DROP

Thats the script, nearly finished, only the create statement for the feckof list is missing.

can someone add this in a comment please?

share|improve this answer
    
One problem i could see is that on my RedHat like systems upon bootup, NAT has to be brought up before iptables and ipset has to be configured before iptables. So if ipset hangs, you might have a NAT with no firewall. –  rjt Jun 27 '13 at 19:49
    
The above iptables command did not work for me, but the following did: iptables -A OUTPUT -m set --match-set feckof src,dst -j DROP –  rjt Jun 27 '13 at 19:50
    
Unfortunately, most lists at ipdeny.com seem to be empty. Not sure if it's a temporary problem or if the site is abandoned. –  mivk Nov 16 '13 at 11:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.