Questions tagged [ipset]

IP sets is a Linux kernel framework to effectively store and manage sets of IP addresses and/or network interfaces.

Filter by
Sorted by
Tagged with
0
votes
0answers
12 views

What does “Header” mean in ipset output?

With ipset utility I'm trying to add port ranges. I create my list such way: # ipset -N SOME2 bitmap:port range 123-500 # ipset list SOME2 Name: SOME2 Type: bitmap:port Revision: 3 Header: range 123-...
0
votes
3answers
452 views

Ipset with Iptables with large list of IP ranges (CIDR)

I have read some answers here about blocking IP address ranges, and have already used iptables for this purpose before. It is suggested to use ipset in combination with iptables. I have only ...
0
votes
0answers
45 views

ipset or iptables keeps crashing my server?

I'm trying to work out why this keeps crashing my server. Weirdly, the server stays up - but nothing can be reached (FTP, Apache, nginx, emails etc). The script is: #!/bin/bash ipset -q flush ...
1
vote
1answer
238 views

ipset rules on iptables do not match

I want to block all ip Adresses except from a specific country. So i installed ipset and downloaded the ip range list from ipdeny.com and did this: ipset create allow-list hash:net for i in $( cat /...
2
votes
1answer
235 views

firewalld, `--add-rich-rule` and missing blacklist set

My server uses Centos8 quite recently installed (~1 year). After trying to ban an IP: firewall-cmd --permanent --zone=extz --add-rich-rule='rule family="ipv4" source address="49.88.112....
4
votes
0answers
2k views

IPsets in FirewallD with Nftables backend

I upgraded my server to Fedora 32. Firewalld has switched the backend to Nftables. My setup is pretty simple. Just HTTP, HTTPS, SSH, SMTP ports open and multiple IPsets (IPv4, IPv6) to block a preset ...
0
votes
1answer
127 views

ipset iptables drop all exclude ports but via rate limit

I have simple ipset map to track suspicious ips. These my commands: ipset flush ipset -q destroy banlists ipset create banlists hash:ip comment family inet hashsize 2048 maxelem 1048576 timeout 300 ...
0
votes
1answer
82 views

Misunderstanding with configuring iptables

It is possible to create iptables logic in such way? accept ssh,http,https drop connection if such ip is already connected (only 1 connection per ip / 1 second). put to blacklist (ipset I guess) if ...
1
vote
3answers
641 views

Using fail2ban, ipset and iptables to block bad IP addresses on Google Compute Engine

I am running Ubuntu Linux 16.04 on a GCP Compute Engine VM instance. This is hosting a web server for a web application. I need feedback from the community about verification that what I have set ...
0
votes
1answer
1k views

Add ip to ipset with port

I would like to block IPs when connectioning on a given port, e.g. 1.1.1.1 on port 443. I create the ipset like this: sudo ipset -N blockdaily nethash maxelem 2500000 I can add an IP to it like ...
0
votes
1answer
729 views

How to use iptables and ipset for destination host redirect to another server?

How to block access to the list of the sites and show a notification page? This example blocking without a page, work correctly: iptables -I FORWARD -m set --match-set site src,dst -j DROP I try to ...
1
vote
1answer
3k views

How to block both IPv4 and IPv6 with ipset on Ubuntu 16.04?

So I have the following script that blocks IPs: #!/bin/bash # here's your list of IPS CURRENT_BL=/path/to/my/ip_black_list.txt # create/flush recreate the tables iptables -F BLACKHOLE iptables -N ...
3
votes
1answer
1k views

Why FirewallD is not blocking IPs with 'reject' rules?

My setup is the follow: fail2ban with some jails (working fine) using FirewallD to block the caught IPs. Here is my default Firewall: myzone target: default icmp-block-inversion: no ...
3
votes
0answers
851 views

GeoIP vs IPset performance in iptables

I would like to ask you what is faster in term of performance GeoIP or IPset. Let me explain, imagine that I have rule: iptables -A INPUT -m geoip ! --src-cc US,UK,CA -j DROP And imagine that I ...
1
vote
1answer
884 views

Why does ipset succeed on adding ipv4 ranges, but fail on adding ipv6 range?

Using ipset to clean up bulky iptable rulesets does not seem so different between IPv4 and IPv6: # ipset create TEST hash:net family inet # ipset create DEMO hash:net family inet6 # iptables -A INPUT ...
0
votes
2answers
2k views

How to update an ipset name-based entry

I need to handle on my firewall (Firehol, which is then transformed into iptables) a few dynamic entries. In an ideal world I would use a name (instead of an IP address) which always points to the ...
0
votes
1answer
2k views

ipset loaded from file?

how to load ipset definition (one setname or more) on reboot from certain file ? for example I have ssh access to linuxbox and want to update setname periodically that way that I have one simple ...
0
votes
1answer
1k views

centos firewalld ipset blacklist ip cidrs on specific ports

I found this link regarding how to set up a blacklist xml file for firewalld: ipset instructions Clear enough, but I don't want to drop access for all ports, just 80 and 443. Suggestions? (BTW the ...
0
votes
1answer
450 views

fail2ban create jail failed

I have debian jessie, with fail2ban v0.8.13 and virtualmin. I use iptables but firewallD was install and uinstall maybe it's the problem.... the problem is: the think for all Jail 2017-09-20 11:33:...
3
votes
1answer
639 views

Why does the 'nomatch' option of ipset not work in this case?

I am using ipset 6.23-2 on Debian Jessie. I created a hash:net set for and an iptables rule to drop all traffic for addresses in the set. Chain INPUT (policy ACCEPT) target prot opt source ...
0
votes
1answer
859 views

IP white list for docker containers with iptables and ipset

I want to restrict access to docker container ports just from specified IPs. I set up iptables rules with ipset. I have exposed the port 8888. The requests from port 8888 are forwarded to simple ...
1
vote
2answers
3k views

Traffic shaping with iptables, ipset and tc (--match-set and --set-mark)

I am having some trouble with what I believe should be a fairly straightforward traffic shaping problem. I have an Ubuntu (16.04) server that is acting as a router/nat. I want to allow most users to ...
0
votes
2answers
888 views

replacing a runtime instance of ipset

I have a running instance of iptables and ipset services. Among them one set has a spec similar to this that has 20+ references to it: create_set foo ipmap --network 123.45.67.0/24 add_to_set foo ...
1
vote
3answers
11k views

Configure Iptables with Ipset

I would highly appreciate it if someone could help on a quite simple ipset rule I am trying to set up. I cannot really understand why it does not seem to work. So here it goes: I create a simple file ...
2
votes
1answer
1k views

ipset not being applied to iptables

I'm trying to filter out a country that keeps probing my SMTP server (CentOS6) and I can't seem to get the ipset to work out right in iptables. I downloaded that countries IP addresses from ipdeny....
0
votes
1answer
234 views

iptables ipset misconfiguration?

I'm looking for a solid method to block unwanted TCP/IP traffic. On my linux machine iptables and ipset seem to offer a nice way to do so. Until now I've done this: ipset create ipsok hash:net ...
0
votes
1answer
3k views

no package ipset available (centos EL5 x86_64)

I want to install ipset, but none of my repos seem to have it when I run yum install ipset [root@ora1 /]# cd /etc/yum.repos.d/ [root@ora1 yum.repos.d]# ls CentOS-Base.repo CentOS-Debuginfo.repo ...
3
votes
1answer
1k views

Can I use iptables to rate limit an ipset?

Is it possible to use iptable tables to rate limit an ipset ? I know you can use ipset to create a block list named blacklist i.e. ipset create blacklist hash:ip iptables -I INPUT -m set --match-...
1
vote
3answers
3k views

IPTables add an IP to IPSet list

How to correctly add an IP address to ipset from an iptables rule? Or isn't that possible at all? This rule doesn't work for me: -A INPUT -m recent --name IP_LIST --set Type of IP_LIST is hash:net ...
1
vote
1answer
5k views

Using Ipset and Iptables for MAC address filtering

I use MAC address filtering on my Linux router. Here is what I have done: iptables -A INPUT -i eth5 -m mac --mac-source 00:07:e9:84:2b:99 -j RETURN #User: Someuser iptables -A INPUT -i eth5 -j DROP ...