Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to simply block all ssh access from anywhere but with in the US. This is my whole iptables, and I have followed http://www.howtoforge.com/xtables-addons-on-centos-6-and-iptables-geoip-filtering

# Generated by iptables-save v1.4.7 on Wed Jul  3 02:30:42 2013
:OUTPUT ACCEPT [1749:280570]
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j DROP
-A INPUT -m geoip --src-cc US --dport 22 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 3000:3050 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
# Completed on Wed Jul  3 02:30:42 2013

I have -A INPUT -m geoip --src-cc US --dport 22 -j ACCEPT and the goal is to only accept ssh from the us where admins work from. as of right now I get an error.

iptables: Applying firewall rules: iptables-restore v1.4.7: Couldn't load match `geoip':/lib64/xtables/libipt_geoip.so:
cannot open shared object file: No such file or directory Error occurred at line: 10

update I have searched for the file and can't find it any were. Ran through the how to and realized that the Xtables-addons was version 1.37, so I updated it 2.5 but there was no change. I look in /lib64/xtables/ and there are tons of files but not the geoip one. So I think that is where I need to start on how to correct the Xtables-addon install I guess.

share|improve this question
"as of right now I get an error". And what is that error? – Patrick Jul 12 '14 at 1:03
your right, I added the error – jeremy.bass Jul 12 '14 at 1:11
Did you set up the datafile stuff at /usr/share/xt_geoip/? Sounds like that's what it's missing. – Patrick Jul 12 '14 at 17:18
@Patrick yes it has the BE/ and LE/ with all the files in it, libipt_geoip.so is just not in /lib64/xtables/ – jeremy.bass Jul 12 '14 at 18:16
up vote 0 down vote accepted

I got the the problem today, finally I've figured out. it's because of selinux, so just turn off selinux, and turn it on after system startup. It works for me, you can try it :)

set selinux to permissive

sudo vim /etc/selinux/config


set selinux enforcing by rc.local

vim /etc/rc.d/rc.local

setenforce 1

share|improve this answer
You should clarify that the two indented lines are not to be run as commands, but are text to be entered. – HalosGhost Oct 6 '14 at 17:30
Super, I'll give it a go, thanks for the update – jeremy.bass Dec 12 '14 at 1:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.