0

I'm downloading the list of CIDRs for Amazon Web Services here:

https://ip-ranges.amazonaws.com/ip-ranges.json

And then putting them on a ipset with the line:

sudo ipset -q -A tor $ip

And blocking with iptables with the line:

sudo iptables -A INPUT -m set --match-set tor src -j DROP

In total there are about 65,000 IPs in the ipset tor. It also has tor IPs blocked and a few others and this is working fine for those, but for some reason it seems unable to block any Amazon IPs.

Any ideas?

Full list of rules:

sudo ipset -N whitelist nethash
sudo iptables -A INPUT -i lo -j ACCEPT                                  
sudo iptables -A INPUT -m set --match-set whitelist src -j ACCEPT
sudo iptables -N BLOCK24
sudo iptables -A BLOCK24 -m recent --name blocked --set
sudo iptables -A INPUT -m state --state NEW -m recent --set
sudo iptables -A INPUT -m state --state NEW -m recent --update --seconds 300 --hitcount 200 -j BLOCK24
sudo iptables -A INPUT -m recent --name blocked --rcheck --seconds 86400 -j BLOCK24
sudo iptables -A BLOCK24 -j LOG --log-prefix='[NETFILTER] ' --log-level 7
sudo iptables -A BLOCK24 -j REJECT

Then first I run these to destory and re-create the block list:

sudo iptables -D INPUT -m set --match-set tor src -j DROP
sudo ipset destroy tor
sudo ipset -N tor iphash

Add cira 65K IPs with:

sudo ipset -q -A tor $ip

Add ipset to iptables:

sudo iptables -A INPUT -m set --match-set tor src -j DROP

Again, everything is blocked except Amazon.

  • 1
    Often it is impossible to diagnose iptables issues properly without seeing the complete firewall config. In general though a frequent issue is that -A option adds that new rule, after all existing rules and that rules are processed in order. One of the preceding rules may be preventing your new rule from matching. The counters in iptables -L -v -n --line-numbers may help diagnose if that's the issue. – HBruijn Mar 27 '17 at 14:47
  • 1
    I suspect you need to be using set type "hash:net" rather than "hash:ip" as the entries in the JSON file are net/mask notation. – parkamark Mar 27 '17 at 15:29
  • @parkamark - That is the correct answer. If you post it as the answer I will accept. – Kohjah Breese Mar 27 '17 at 20:05
5

The set type needs to be hash:net rather than hash:ip as the entries in the JSON file are net/mask notation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.