0

I have a very strange problem with fail2ban/iptables. Something is not working right, but I can't figoure out what.

I have added this conf & and filter for fail2ban:

[wordpress-register]
enabled = true
port = http,https
filter = wordpress-register 
logpath = /var/log/nginx/access.log

[Definition] 

failregex = ^<HOST> .* "GET /wp-login.php\?action=register HTTP/.*" .*$

Fail2ban starts, but has this in the error logs:

2014-09-22 15:14:35,794 fail2ban.server.action[5275]: ERROR ipset create fail2ban-wordpress-register hash:ip timeout 600

firewall-cmd --direct --add-rule ipv4 filter INPUT 0 -p tcp -m multiport --dports http,https -m set --match-set fail2ban-wordpress-register src -j REJECT --reject-with icmp-port-unreachable -- stderr: 'ipset v6.19: Kernel error received: set type not supported\n'

2014-09-21 02:57:43,860 fail2ban.server.action[1191]: ERROR ipset create fail2ban-wordpress-register hash:ip timeout 600 firewall-cmd --direct --add-rule ipv4 filter INPUT 0 -p tcp -m multiport --dports http,https -m set --match-set fail2ban-wordpress-register src -j REJECT --reject-with icmp-port-unreachable -- stdout: "\x1b[91mError: COMMAND_FAILED: '/sbin/iptables -t filter -I INPUT_direct 1 -p tcp -m multiport --dports http,https -m set --match-set fail2ban-wordpress-register src -j REJECT --reject-with icmp-port-unreachable' failed: iptables v1.4.21: Set fail2ban-wordpress-register doesn't exist.\n\nTry `iptables -h' or 'iptables --help' for more information.\x1b[00m\n"

Any idea what the problem could be? I guess the main thing is that:

ipset v6.19: Kernel error received: set type not supported

But, what does that mean?

1
+50

The ipset command requires IP SET support in the kernel. Specifically, you would be looking for the following settings:

CONFIG_IP_SET=m
CONFIG_IP_SET_HASH_IP=m

And it seems that your kernel is built without ipset support, or at the least, it cannot find these modules. Solve that issue and your error should go away.

Try running find /lib/modules/$(uname -r) -name ip_set.ko to see if you current kernel supports them, and also find /lib/modules -name ip_set.ko to see if any of the installed kernel supports them.

If you need more help, you would have to tell us:

  1. What version of CentOS you are using
  2. What kernel you are running
  3. How you installed fail2ban (from the EPEL repository or manually?)

I should also note that the version of ipset reported in your question (6.19) is what CentOS 7 comes with, so if you are using the original kernel and fail2ban from the EPEL repo everything should just work.

CentOS 6.5 also has support for ip sets and fail2ban is available in EPEL for CentOS 6. These should also work fine.

However, if you are running CentOS 5, then you are likely out of luck. You may have some luck building the modules that ipset comes with, but I am not sure the CentOS 5 kernel is supported at all. If you actually managed to pull that off, and later upgraded the kernel, then it is just a matter of rebuilding the modules for the new kernel.

  • Thanks for your detailed answer. I use CentOS 7 (Kernel: 2.6.32-042stab092.2), fail2ban has been installed automatically with Plesk 12. The first commands output a "File not found", the second one /lib/modules/3.10.0-123.6.3.el7.x86_64/kernel/net/netfilter/ipset/ip_set.ko. I am not to experienced with Unix (even though i do my best to get better and better) so i would really appreciate it if you could guide me a bit in order to fix this issue. Thank you very much for your time. – TheNiceGuy Sep 26 '14 at 1:00
  • As you can see, your running kernel (2.6.32-042stab092.2) is not a CentOS 7 kernel. It seems that you are inside a virtualized OpenVZ container. You may want to bring this up with your hosting provider, or also check this for extra information: unix.stackexchange.com/questions/118263/… – chutz Sep 26 '14 at 2:38
  • Oh, that is sad. Alright i guess I will get a dedicated server then. Thanks anyways :) – TheNiceGuy Sep 28 '14 at 16:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.