Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [ipset]

IP sets is a Linux kernel framework to effectively store and manage sets of IP addresses and/or network interfaces.

0
votes
0answers
11 views

ipset ip DROP/ACCEPT log

i'm using ipset with a big set of addresses but i can't get a fairly accurate log. Setting iptables log I only have a packet counter for each set and the corresponding set. Is there a way to verify ...
0
votes
1answer
31 views

How to use iptables and ipset for destination host redirect to another server?

How to block access to the list of the sites and show a notification page? This example blocking without a page, work correctly: iptables -I FORWARD -m set --match-set site src,dst -j DROP I try to ...
0
votes
1answer
48 views

How to block both IPv4 and IPv6 with ipset on Ubuntu 16.04?

So I have the following script that blocks IPs: #!/bin/bash # here's your list of IPS CURRENT_BL=/path/to/my/ip_black_list.txt # create/flush recreate the tables iptables -F BLACKHOLE iptables -N ...
0
votes
0answers
21 views

OpenVZ Container to respect host node iptable rules

I'm trying to block outbound traffic to certain IP Addresses from within OpenVZ containers. The host node has a list of IP addresses setup using ipset. The host node itself is succesfully blocking ...
3
votes
1answer
49 views

Why FirewallD is not blocking IPs with 'reject' rules?

My setup is the follow: fail2ban with some jails (working fine) using FirewallD to block the caught IPs. Here is my default Firewall: myzone target: default icmp-block-inversion: no ...
3
votes
0answers
323 views

GeoIP vs IPset performance in iptables

I would like to ask you what is faster in term of performance GeoIP or IPset. Let me explain, imagine that I have rule: iptables -A INPUT -m geoip ! --src-cc US,UK,CA -j DROP And imagine that I ...
0
votes
1answer
165 views

Why does ipset succeed on adding ipv4 ranges, but fail on adding ipv6 range?

Using ipset to clean up bulky iptable rulesets does not seem so different between IPv4 and IPv6: # ipset create TEST hash:net family inet # ipset create DEMO hash:net family inet6 # iptables -A INPUT ...
0
votes
2answers
203 views

How to update an ipset name-based entry

I need to handle on my firewall (Firehol, which is then transformed into iptables) a few dynamic entries. In an ideal world I would use a name (instead of an IP address) which always points to the ...
0
votes
1answer
581 views

ipset loaded from file?

how to load ipset definition (one setname or more) on reboot from certain file ? for example I have ssh access to linuxbox and want to update setname periodically that way that I have one simple ...
0
votes
1answer
653 views

centos firewalld ipset blacklist ip cidrs on specific ports

I found this link regarding how to set up a blacklist xml file for firewalld: ipset instructions Clear enough, but I don't want to drop access for all ports, just 80 and 443. Suggestions? (BTW the ...
0
votes
1answer
286 views

fail2ban create jail failed

I have debian jessie, with fail2ban v0.8.13 and virtualmin. I use iptables but firewallD was install and uinstall maybe it's the problem.... the problem is: the think for all Jail 2017-09-20 11:33:...
3
votes
1answer
188 views

Why does the 'nomatch' option of ipset not work in this case?

I am using ipset 6.23-2 on Debian Jessie. I created a hash:net set for and an iptables rule to drop all traffic for addresses in the set. Chain INPUT (policy ACCEPT) target prot opt source ...
0
votes
1answer
540 views

IP white list for docker containers with iptables and ipset

I want to restrict access to docker container ports just from specified IPs. I set up iptables rules with ipset. I have exposed the port 8888. The requests from port 8888 are forwarded to simple ...
1
vote
2answers
943 views

Traffic shaping with iptables, ipset and tc (--match-set and --set-mark)

I am having some trouble with what I believe should be a fairly straightforward traffic shaping problem. I have an Ubuntu (16.04) server that is acting as a router/nat. I want to allow most users to ...
0
votes
2answers
191 views

replacing a runtime instance of ipset

I have a running instance of iptables and ipset services. Among them one set has a spec similar to this that has 20+ references to it: create_set foo ipmap --network 123.45.67.0/24 add_to_set foo ...
0
votes
3answers
3k views

Configure Iptables with Ipset

I would highly appreciate it if someone could help on a quite simple ipset rule I am trying to set up. I cannot really understand why it does not seem to work. So here it goes: I create a simple file ...
2
votes
1answer
499 views

ipset not being applied to iptables

I'm trying to filter out a country that keeps probing my SMTP server (CentOS6) and I can't seem to get the ipset to work out right in iptables. I downloaded that countries IP addresses from ipdeny....
0
votes
1answer
193 views

iptables ipset misconfiguration?

I'm looking for a solid method to block unwanted TCP/IP traffic. On my linux machine iptables and ipset seem to offer a nice way to do so. Until now I've done this: ipset create ipsok hash:net ...
0
votes
1answer
2k views

no package ipset available (centos EL5 x86_64)

I want to install ipset, but none of my repos seem to have it when I run yum install ipset [root@ora1 /]# cd /etc/yum.repos.d/ [root@ora1 yum.repos.d]# ls CentOS-Base.repo CentOS-Debuginfo.repo ...
3
votes
1answer
616 views

Can I use iptables to rate limit an ipset?

Is it possible to use iptable tables to rate limit an ipset ? I know you can use ipset to create a block list named blacklist i.e. ipset create blacklist hash:ip iptables -I INPUT -m set --match-...
1
vote
3answers
2k views

IPTables add an IP to IPSet list

How to correctly add an IP address to ipset from an iptables rule? Or isn't that possible at all? This rule doesn't work for me: -A INPUT -m recent --name IP_LIST --set Type of IP_LIST is hash:net ...
1
vote
1answer
4k views

Using Ipset and Iptables for MAC address filtering

I use MAC address filtering on my Linux router. Here is what I have done: iptables -A INPUT -i eth5 -m mac --mac-source 00:07:e9:84:2b:99 -j RETURN #User: Someuser iptables -A INPUT -i eth5 -j DROP ...