Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I would like to use this tutorial:

In Ubuntu 12.04 the package ipset-source is removed from the repository I guess that's why I only get an error when I try installing it like this:

apt-get install module-assistant ipset
m-a a-i ipset

How would I do that in Ubuntu precise?

share|improve this question

3 Answers 3

up vote 0 down vote accepted

I think you do something wrong. That article is not up to date because it's about 10.04 LTS. Now you can just issue

sudo apt-get install ipset

I've just installed ipset on my 12.04 without any problem. Take a look at my install log

share|improve this answer
i did that too, and there were no errors either. but don't I have to build and install the kernel module anymore? –  rubo77 Sep 14 '12 at 7:44
ok, there was no error installing it, just errors on that tutorial at jsimmons –  rubo77 Sep 14 '12 at 7:57
I found an example here like this: ipset create foo bitmap:ip range; ipset add foo 192.168.1/24; ipset test foo; is that all i need to change the script on… ? –  rubo77 Sep 14 '12 at 7:58
Yes exactly this is what you need to do –  hostmaster Sep 14 '12 at 8:27
how would i create a group then, than can consist of thousands of ip-ranges? ipset create foo bitmap:ip range ? –  rubo77 Sep 22 '12 at 2:51

Worst case scenario just download the source from Ipset and compile it manually.

tar xvfj ipset-6.13.tar.bz2
cd ipset-6.13
make check
make install

For more info check the README or INSTALL or run ./configure --help for some exotic options.

share|improve this answer
thx, but apt-get is just fine ;) –  rubo77 Sep 14 '12 at 9:59
haha that's too easy :)) –  golja Sep 15 '12 at 14:30
ipset has come a looong way... I remember having to compile from source. Ubuntu is getting more enjoyable, lately :) –  pepoluan Sep 10 '13 at 12:37

This is how this tutoriall at jsimmons works on Ubuntu 12.04:

sudo apt-get install ipset

# enter the countrycode that you dont want to block here (for example de for Germay):

# download the zonefiles into /tmp/zones/
cd /tmp
mkdir zones
cd zones
tar -xzvf ../all-zones.tar.gz
# remove the zone you want to keep:
rm /tmp/zones/$

mkdir $FOLDER
cat /tmp/zones/*.zone > $BLOCKLIST

#if you want to block only the biggest blocks, use the short list:



#TODO: create the list with the right command
#ipset create feckof ...
ipset --create feckoff bitmap:ip range [fromip-toip|ip/cidr]

for i in $IPS; do
ipset add feckof $i

iptables -A INPUT -m set –set feckoff src -j DROP

Thats the script, nearly finished, only the create statement for the feckof list is missing.

can someone add this in a comment please?

share|improve this answer
One problem i could see is that on my RedHat like systems upon bootup, NAT has to be brought up before iptables and ipset has to be configured before iptables. So if ipset hangs, you might have a NAT with no firewall. –  rjt Jun 27 '13 at 19:49
The above iptables command did not work for me, but the following did: iptables -A OUTPUT -m set --match-set feckof src,dst -j DROP –  rjt Jun 27 '13 at 19:50
Unfortunately, most lists at seem to be empty. Not sure if it's a temporary problem or if the site is abandoned. –  mivk Nov 16 '13 at 11:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.