Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I want to simply block all ssh access from anywhere but with in the US. This is my whole iptables, and I have followed http://www.howtoforge.com/xtables-addons-on-centos-6-and-iptables-geoip-filtering

# Generated by iptables-save v1.4.7 on Wed Jul  3 02:30:42 2013
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1749:280570]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j DROP
-A INPUT -m geoip --src-cc US --dport 22 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 3000:3050 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Wed Jul  3 02:30:42 2013

I have -A INPUT -m geoip --src-cc US --dport 22 -j ACCEPT and the goal is to only accept ssh from the us where admins work from. as of right now I get an error.

iptables: Applying firewall rules: iptables-restore v1.4.7: Couldn't load match `geoip':/lib64/xtables/libipt_geoip.so:
cannot open shared object file: No such file or directory Error occurred at line: 10

update I have searched for the file and can't find it any were. Ran through the how to and realized that the Xtables-addons was version 1.37, so I updated it 2.5 but there was no change. I look in /lib64/xtables/ and there are tons of files but not the geoip one. So I think that is where I need to start on how to correct the Xtables-addon install I guess.

share|improve this question
    
"as of right now I get an error". And what is that error? –  Patrick Jul 12 at 1:03
    
your right, I added the error –  jeremy.bass Jul 12 at 1:11
    
Did you set up the datafile stuff at /usr/share/xt_geoip/? Sounds like that's what it's missing. –  Patrick Jul 12 at 17:18
    
@Patrick yes it has the BE/ and LE/ with all the files in it, libipt_geoip.so is just not in /lib64/xtables/ –  jeremy.bass Jul 12 at 18:16

1 Answer 1

I got the the problem today, finally I've figured out. it's because of selinux, so just turn off selinux, and turn it on after system startup. It works for me, you can try it :)

set selinux to permissive

sudo vim /etc/selinux/config

SELINUX=permissive

set selinux enforcing by rc.local

vim /etc/rc.d/rc.local

setenforce 1

share|improve this answer
    
You should clarify that the two indented lines are not to be run as commands, but are text to be entered. –  HalosGhost Oct 6 at 17:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.