2

I would like to use this tutorial: http://www.jsimmons.co.uk/2010/06/08/using-ipset-with-iptables-in-ubuntu-lts-1004-to-block-large-ip-ranges/

In Ubuntu 12.04 the package ipset-source is removed from the repository I guess that's why I only get an error when I try installing it like this:

apt-get install module-assistant ipset
m-a a-i ipset

How would I do that in Ubuntu precise?

3 Answers 3

1

I think you do something wrong. That article is not up to date because it's about 10.04 LTS. Now you can just issue

sudo apt-get install ipset

I've just installed ipset on my 12.04 without any problem. Take a look at my install log https://gist.github.com/3720382

7
  • i did that too, and there were no errors either. but don't I have to build and install the kernel module anymore?
    – rubo77
    Sep 14, 2012 at 7:44
  • ok, there was no error installing it, just errors on that tutorial at jsimmons
    – rubo77
    Sep 14, 2012 at 7:57
  • I found an example here manpages.ubuntu.com/manpages/precise/man8/ipset.8.html like this: ipset create foo bitmap:ip range 192.168.0.0/16; ipset add foo 192.168.1/24; ipset test foo 192.168.1.1; is that all i need to change the script on jsimmons.co.uk/2010/06/08/… ?
    – rubo77
    Sep 14, 2012 at 7:58
  • Yes exactly this is what you need to do
    – hostmaster
    Sep 14, 2012 at 8:27
  • how would i create a group then, than can consist of thousands of ip-ranges? ipset create foo bitmap:ip range 0.0.0.0/8 ?
    – rubo77
    Sep 22, 2012 at 2:51
2

This is how this tutoriall at jsimmons works on Ubuntu 12.04:

sudo apt-get install ipset

# enter the countrycode that you dont want to block here (for example de for Germay):
DONTBLOCK=de

# download the zonefiles into /tmp/zones/
cd /tmp
wget http://www.ipdeny.com/ipblocks/data/countries/all-zones.tar.gz
mkdir zones
cd zones
tar -xzvf ../all-zones.tar.gz
# remove the zone you want to keep:
rm /tmp/zones/$DONTBLOCK.zone

FOLDER=/etc/zoneipblock/
mkdir $FOLDER
BLOCKLIST=$FOLDER"non_$DONTBLOCK.zone_blocklist"
cat /tmp/zones/*.zone > $BLOCKLIST

#if you want to block only the biggest blocks, use the short list:
BLOCKLIST_SHORT="$BLOCKLIST"_short
cat $BLOCKLIST |grep /8>$BLOCKLIST_SHORT
cat $BLOCKLIST |grep /9>>$BLOCKLIST_SHORT
cat $BLOCKLIST |grep /10>>$BLOCKLIST_SHORT
cat $BLOCKLIST |grep /11>>$BLOCKLIST_SHORT
cat $BLOCKLIST |grep /12>>$BLOCKLIST_SHORT

IPS=$(cat $BLOCKLIST_SHORT)

exit

#TODO: create the list with the right command
#ipset create feckof ...
ipset --create feckoff bitmap:ip range [fromip-toip|ip/cidr]

for i in $IPS; do
ipset add feckof $i
done

iptables -A INPUT -m set –set feckoff src -j DROP

Thats the script, nearly finished, only the create statement for the feckof list is missing.

can someone add this in a comment please?

3
  • One problem i could see is that on my RedHat like systems upon bootup, NAT has to be brought up before iptables and ipset has to be configured before iptables. So if ipset hangs, you might have a NAT with no firewall.
    – rjt
    Jun 27, 2013 at 19:49
  • The above iptables command did not work for me, but the following did: iptables -A OUTPUT -m set --match-set feckof src,dst -j DROP
    – rjt
    Jun 27, 2013 at 19:50
  • Unfortunately, most lists at ipdeny.com seem to be empty. Not sure if it's a temporary problem or if the site is abandoned.
    – mivk
    Nov 16, 2013 at 11:45
0

Worst case scenario just download the source from Ipset and compile it manually.

wget http://ipset.netfilter.org/ipset-6.13.tar.bz2
tar xvfj ipset-6.13.tar.bz2
cd ipset-6.13
./configure
make
make check
make install

For more info check the README or INSTALL or run ./configure --help for some exotic options.

3
  • thx, but apt-get is just fine ;)
    – rubo77
    Sep 14, 2012 at 9:59
  • haha that's too easy :))
    – golja
    Sep 15, 2012 at 14:30
  • ipset has come a looong way... I remember having to compile from source. Ubuntu is getting more enjoyable, lately :)
    – pepoluan
    Sep 10, 2013 at 12:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .