Hot answers tagged

5 votes
Accepted

How to block both IPv4 and IPv6 with ipset on Ubuntu 16.04?

You need to create the ipset using the following command: $ sudo ipset create ipset-blacklist hash:ip family inet6 The option family { inet | inet6 } defines the protocol family of the IP addresses ...
Khaled's user avatar
  • 36.8k
4 votes

How to update an ipset name-based entry

That doesn't seem like the best way to block a web site that has many IP addresses. Nevertheless, this will work even if you have multiple IP addresses in an ipset list: Instead of rewriting the ...
Michael Hampton's user avatar
4 votes
Accepted

replacing a runtime instance of ipset

You should create NEW set with ipset create foo-new ... add entries there and then swap the two: ipset swap foo-new foo and destroy the no longer needed set: ipset destroy foo-new
Tomek's user avatar
  • 3,543
3 votes
Accepted

In Linux how to add a route to a prefix via a specific device with certain destinations in that prefix going via default route?

As it turns out, in Linux one can use ipset matching to select routing tables. The extra ingredient is using a netfilter rule that will match the outgoing packets and apply a fwmark to them, which ...
datenwolf's user avatar
  • 299
3 votes

Why FirewallD is not blocking IPs with 'reject' rules?

Debian/Ubuntu don't have a default banaction for firewalld because that's not the default firewall for those distributions. You should set banaction = firewallcmd-ipset, to make an ipset that ...
Michael Hampton's user avatar
3 votes

Configure Iptables with Ipset

I may have to answer my own question as it looks like that nobody at serverfault knows the answer. Well, this is really simple. Since iptable rules work successively then all that was needed was to ...
Klaipedaville's user avatar
3 votes

Can I use iptables to rate limit an ipset?

Yes, It is. I made a simple test using: ipset create ratelimit hash:ip hashsize 4096 ipset add ratelimit <ip_address> iptables -I INPUT -m set --match-set ratelimit src -p tcp --dport 80 -m ...
fgbreel's user avatar
  • 673
2 votes

Configure Iptables with Ipset

The problem is with the iptables rule: -A INPUT -p tcp --match multiport --dport 25,587 -m set --match-set blocklist src -j DROP ^^^^^^^ The parameter for multiport ...
Tomek's user avatar
  • 3,543
2 votes

centos firewalld ipset blacklist ip cidrs on specific ports

Initialize the blacklist ipset just as in the link you mentioned, but instead of using firewall-cmd --add-rich-rule='rule source ipset=blacklist drop' to tie the blacklist to the rest of the ruleset,...
telcoM's user avatar
  • 4,578
2 votes
Accepted

Why does ipset succeed on adding ipv4 ranges, but fail on adding ipv6 range?

The fromaddr-toaddr syntax is only supported for IPv4. Use cidr notation to add IPv6 ranges. For the inet family one can add or delete multiple entries by specifying a range or a network of IPv4 ...
anx's user avatar
  • 9,639
2 votes
Accepted

Ipset with Iptables with large list of IP ranges (CIDR)

There is a command line utilty named aggregate. It takes a list of CIDR netblocks and aggregates consecutive blocks into the corresponding larger block. It also removes redundant netblocks. For ...
Michael Hampton's user avatar
2 votes

In Linux how to add a route to a prefix via a specific device with certain destinations in that prefix going via default route?

Routes are calculated on a most-specific-first approach. So if your small subnet needs the default route, put that first and then add the others: Default Gateway in this example is 10.0.0.1 VPN is 10....
shearn89's user avatar
  • 3,486
1 vote
Accepted

How can I organize the IPs/CIDR when executing restore ipset?

Some background information on ipset: This is a command line tool to manipulate datasets which resize within the kernel memory. As such, ipset is just a wrapper to call the actual code, which resides ...
Martin's user avatar
  • 2,374
1 vote
Accepted

how to add multiples ips cidr with ipset save and restore options

This worked for me: # remove any old reference to the ipset iptables -D FORWARD -m set --match-set blacklist dst -j DROP ipset destroy ipset create blacklist hash:net family inet hashsize 1024 ipset ...
Martin's user avatar
  • 2,374
1 vote
Accepted

Shorewall: IPSet from blrules not applying

Your configuration snippets contain only the "from" rules, so the IPSets currently have effect only on the incoming connections. If you want to block outgoing packets as well, you need to ...
Lacek's user avatar
  • 7,393
1 vote
Accepted

Ratelimit IPs for UDP traffic in ipset list before being sent over GRE tunnel

It seems this was the better rule - stops the traffic before going over the GRE tunnel over the limit iptables -t mangle -A PREROUTING -p udp --dport 30000 -m set --match-set blacklist src -m ...
Rushy's user avatar
  • 21
1 vote

Ipset with Iptables with large list of IP ranges (CIDR)

Usually the max length of an ipset list is 65536 elements, so you might have to use a separate list for each country you want to block. Using a hash:net set you can directly add the CIDR records you ...
Dobromir Velev's user avatar
1 vote
Accepted

ipset rules on iptables do not match

I spoke with my isp and its their fault. They have an weird network. So i always only get an internal ip address from every package that arrive.
Samhamsam's user avatar
1 vote
Accepted

ipset iptables drop all exclude ports but via rate limit

If you want to allow ports 80 and 443, you can add one more rule for INPUT chain: iptables -I INPUT 1 -m set -j DROP --match-set banlists src iptables -I INPUT 1 -p tcp -m multiport --dports 80,443 -...
Khaled's user avatar
  • 36.8k
1 vote
Accepted

Misunderstanding with configuring iptables

I assume that limits (you have mentioned in 2. and 3.) are applied to allowed connections to ssh/http/https. Also, I assume that you want to apply limit to source IP regardless to destination port (i....
Halis's user avatar
  • 247
1 vote
Accepted

Add ip to ipset with port

To use the port number, you should create appropriate the hash type. ipset create blockdaily hash:ip,port You can add elements with similar commands: ipset add blockdaily 1.1.1.1,tcp:443 ipset add ...
Anton Danilov's user avatar
1 vote

How to use iptables and ipset for destination host redirect to another server?

you are trying to use DNAT which is a target for the nat table in the filter table. If you want to use the DNAT target, you will have to use iptables -t nat -I PREROUTING instead of iptables -I ...
Andreas Rogge's user avatar
1 vote

How to update an ipset name-based entry

Your problem is two fold: your firewall works by blocking/allowing connections to specific IP-addresses, ranges of IP-addresses and ports. If you configure your firewall with hostnames rather than ...
HBruijn's user avatar
  • 80k
1 vote
Accepted

ipset loaded from file?

very very shortened version: wget -qN http://192.168.10.50:9997/MT/maclist_raw maclist_data=$(cat maclist_raw) ipset create ipset_list_name hash:mac for row_data in $maclist_data; do ipset add ...
Peter Maly's user avatar
1 vote
Accepted

fail2ban create jail failed

Seems to me that during the fail2ban installation the firewalld was present, fail2ban installer detected it and created appropriate configuration for this scenario in fail2ban. You should look for ...
bocian85's user avatar
  • 822
1 vote

Traffic shaping with iptables, ipset and tc (--match-set and --set-mark)

One thought ... your set contains MAC addresses, but I suspect that the PREROUTING rule is trying to match src or dst IP addresses rather than MAC addresses.
interoperate's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible