Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Due to too many hack attempts from spam countries, today got the server configured with IPset for iptables.

I loaded thousands of ip range in IPset & then added it to iptables with this command

iptables -A INPUT -m set --set Cblock src -j DROP

Cblock is the name I gave for the ipset rule containing 20 countries ip range

All is good! but the moment I start APF firewall, ipset rules no longer in effect even though it still shows up in the status.

service iptables status

I checked APF config file & there is no mention about IPset. I also tried to start APF first & then load IPset rules. This approach also did not make a difference.

Anyone had similar circumstance to tackle? I use APF to deal with spamhouse ip's, port blocking etc.

Is there any other firewall wrapper that is compatible with IPset?

share|improve this question
up vote 0 down vote accepted

I'm pretty sure this is not related to ipset at all.

If you have any manual configuration in iptables, APF simply replaces them with their own rules.

Use iptables -L to check if your rule is still present and reachable.

Starting APF first and adding your rule afterwards should work. Be aware that iptable -A adds a rule at the end after all the other rules. If APF accepts the connection, your rule will never be reached. Use iptables -I to insert a rule at the beginning.

share|improve this answer
thanks for the solution. iptables -I did the trick. – JoshG Feb 26 '14 at 23:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.