I have got the following error messages repeating in firewalld log file.
2019-07-19 14:18:20 ERROR: COMMAND_FAILED: Direct: '/usr/sbin/iptables-restore -w -n' failed: iptables-restore v1.4.21: Set fail2ban-ssh doesn't exist. Error occurred at line: 2 Try `iptables-restore -h' or 'iptables-restore --help' for more information.
I searched here and there to fix this error with no luck. I am using Centos7 with firewalld and fail2ban.
I don't know where is the issue exactly. Is this related to fail2ban or firewalld?
Running systemctl status firewalld -l shows the following error messages:
firewalld: WARNING: '/usr/sbin/iptables-restore --wait=2 -n' failed: iptables-restore v1.4.21: Set fail2ban-sshd doesn't exist. Error occurred at line: 2 Try 'iptables-restore -h' or 'iptables-restore --help' for more information. firewalld: ERROR: COMMAND_FAILED
I have the following content of jail.local for fail2ban:
[DEFAULT] ignoreip = 127.0.0.0/8 bantime = 86400 findtime = 86400 maxretry = 5 # Override /etc/fail2ban/jail.d/00-firewalld.conf: banaction = firewallcmd-ipset [sshd] enabled = true [ssh] enabled = true filter = sshd action = %(action_)s logpath = /var/log/secure maxretry = 5
All other configurations are per the system defaults.
I installed firewalld as per the following:
sudo yum install firewalld sudo systemctl start firewalld sudo firewall-cmd --permanent --add-service=ssh sudo firewall-cmd --permanent --add-service=http sudo firewall-cmd --permanent --add-service=https sudo firewall-cmd --permanent --remove-service=smtp sudo systemctl enable firewalld
Finally, performing the following command:
# firewall-cmd --direct --get-all-rules
I get these results:
ipv4 filter INPUT 0 -p tcp -m multiport --dports ssh -m set --match-set fail2ban-sshd src -j REJECT --reject-with icmp-port-unreachable ipv4 filter INPUT 0 -p tcp -m multiport --dports 0:65535 -m set --match-set fail2ban-ssh src -j REJECT --reject-with icmp-port-unreachable
I appreciate your assistance as I am more to development than to servers.
I am really in need to fix this as soon as possible. It is for my production server.