I would like to use this tutorial: http://www.jsimmons.co.uk/2010/06/08/using-ipset-with-iptables-in-ubuntu-lts-1004-to-block-large-ip-ranges/

In Ubuntu 12.04 the package ipset-source is removed from the repository I guess that's why I only get an error when I try installing it like this:

apt-get install module-assistant ipset
m-a a-i ipset

How would I do that in Ubuntu precise?


I think you do something wrong. That article is not up to date because it's about 10.04 LTS. Now you can just issue

sudo apt-get install ipset

I've just installed ipset on my 12.04 without any problem. Take a look at my install log https://gist.github.com/3720382

  • i did that too, and there were no errors either. but don't I have to build and install the kernel module anymore? – rubo77 Sep 14 '12 at 7:44
  • ok, there was no error installing it, just errors on that tutorial at jsimmons – rubo77 Sep 14 '12 at 7:57
  • I found an example here manpages.ubuntu.com/manpages/precise/man8/ipset.8.html like this: ipset create foo bitmap:ip range; ipset add foo 192.168.1/24; ipset test foo; is that all i need to change the script on jsimmons.co.uk/2010/06/08/… ? – rubo77 Sep 14 '12 at 7:58
  • Yes exactly this is what you need to do – hostmaster Sep 14 '12 at 8:27
  • how would i create a group then, than can consist of thousands of ip-ranges? ipset create foo bitmap:ip range ? – rubo77 Sep 22 '12 at 2:51

This is how this tutoriall at jsimmons works on Ubuntu 12.04:

sudo apt-get install ipset

# enter the countrycode that you dont want to block here (for example de for Germay):

# download the zonefiles into /tmp/zones/
cd /tmp
wget http://www.ipdeny.com/ipblocks/data/countries/all-zones.tar.gz
mkdir zones
cd zones
tar -xzvf ../all-zones.tar.gz
# remove the zone you want to keep:
rm /tmp/zones/$DONTBLOCK.zone

mkdir $FOLDER
cat /tmp/zones/*.zone > $BLOCKLIST

#if you want to block only the biggest blocks, use the short list:



#TODO: create the list with the right command
#ipset create feckof ...
ipset --create feckoff bitmap:ip range [fromip-toip|ip/cidr]

for i in $IPS; do
ipset add feckof $i

iptables -A INPUT -m set –set feckoff src -j DROP

Thats the script, nearly finished, only the create statement for the feckof list is missing.

can someone add this in a comment please?

  • One problem i could see is that on my RedHat like systems upon bootup, NAT has to be brought up before iptables and ipset has to be configured before iptables. So if ipset hangs, you might have a NAT with no firewall. – rjt Jun 27 '13 at 19:49
  • The above iptables command did not work for me, but the following did: iptables -A OUTPUT -m set --match-set feckof src,dst -j DROP – rjt Jun 27 '13 at 19:50
  • Unfortunately, most lists at ipdeny.com seem to be empty. Not sure if it's a temporary problem or if the site is abandoned. – mivk Nov 16 '13 at 11:45

Worst case scenario just download the source from Ipset and compile it manually.

wget http://ipset.netfilter.org/ipset-6.13.tar.bz2
tar xvfj ipset-6.13.tar.bz2
cd ipset-6.13
make check
make install

For more info check the README or INSTALL or run ./configure --help for some exotic options.

  • thx, but apt-get is just fine ;) – rubo77 Sep 14 '12 at 9:59
  • haha that's too easy :)) – golja Sep 15 '12 at 14:30
  • ipset has come a looong way... I remember having to compile from source. Ubuntu is getting more enjoyable, lately :) – pepoluan Sep 10 '13 at 12:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.