The tag has no usage guidance.

learn more… | top users | synonyms

5
votes
4answers
10k views

iptables rules not reloading on CentOS 6.x

I have one single ipset added to my iptables on a CentOS 6.x box and this rule is lost when the machine reboots. I've found this answer showing how to make a Ubuntu system reload the iptables rules ...
5
votes
1answer
384 views

Is there a way to match an inet and inet6 IP set in a single rule?

Is it possible to have one IPv4 and one IPv6 IP set (ipset(8)) within the same rule? I have several rules that depend on one set of IPv4 addresses and another set of IPv6 addresses respectively, but ...
4
votes
2answers
449 views

Can iptables rules manipulate IP sets?

In iptables-extensions(8) the set module is described and it is discussed that it is possible to react to the presence or absence of an IP or more generally a match against an IP set. However, it ...
3
votes
1answer
222 views

How to combine connlimit with IP sets?

connlimit lets me limit the number of connections per client/service. How would I go about to combine such a rule with the IP sets available in more recent versions of the Linux kernel and netfilter?
2
votes
1answer
172 views

Do I have to swap IP sets, or can I add/remove on the fly?

I was wondering about the semantics of ipset(8). Is it possible to add a rule matching a set to iptables and then manipulate the set, or can I only create a set and swap it for an older set in order ...
2
votes
1answer
503 views

iptables is not blocking

I have a script running every minute by a crontab. This script scans the system logs and grabs the IPs of every failed attempt to login on the server's dovecot, exim or ssh and add them to an ipset, ...
2
votes
2answers
685 views

iptables… blocking a range without flooding ipset set with IPs

I have this range of IPS 197.192.x.x that is brute force attacking my pop/imap/smtp servers day after day. I have this ipset in place that is blocking every IP that tries to hack on my server. I ...
2
votes
1answer
133 views

Using iptables to block for specific services

I am using ipset in conjunction with iptables to create a list of IPs I want to block. I did this: ipset -N blocking iphash ipset -A blocking 124.205.11.230 // and repeated this line for all IPs I ...
2
votes
2answers
125 views

ipset accounting information

I know that iptables keeps accounting information for ip traffic blocked or passed. However, it appears that when using ipsets with iptables, the accounting information is aggregated for the entire ...
2
votes
1answer
185 views

How can I let ipset entries “age”?

I am trying to establish a whitelist of clients that have successfully logged into the system, using ipset. What options do I have to let an entry age so that I can later discard it based on its age? ...
1
vote
2answers
402 views

iptables and logs

Suppose I add an IP to iptables blocking for exim, dovecot and FTP and this IP visits my server again. Is there any log of this visit so I can confirm the IP was trying to reach the server again but ...
1
vote
0answers
55 views

Change timeout of an entry of ipset with iptables rule

I'm trying to create a set with ipset and using it in some iptables rules. ipset has timeout option to set a countdown timeout to an entry of a set to automatically remove it after a period of time. ...
1
vote
0answers
91 views

How to match properly against an IP set of type 'hash:ip,port'?

My current setup is that I have a server with several IPv4 addresses. Let's ignore the IPv6 part for now, as the symptoms are identical there. In the firewall rules I'd like to match against HTTP ...
1
vote
0answers
619 views

What alternatives are there to ipset for blocking large sets of ip addresses / address ranges?

Are there alternatives to ipset that offer similar efficiency in handling large sets of ip addresses or ip address ranges? We originally used iptables to selectively block access to our servers for ...
1
vote
1answer
521 views

How do I allow only certain IPSet set's to access a certain port with iptables?

I'm using IPSet to build IP ranges for different countries as follows : # Canada ipset -F ca.zone ipset -N ca.zone nethash for IP in $(wget -O - http://www.ipdeny.com/ipblocks/data/countries/ca.zone) ...
0
votes
1answer
407 views

IP set to block access to exim and dovecot

I have created a ipset with a bunch of IPs that I want to block access to dovecot and exim. The ipset is called "bannedIPs" and have been added to iptables using this iptables -A INPUT -p tcp ...
0
votes
2answers
318 views

ipset not executing from crontab

I have this txt files that contains IPs, one per line of file, that I want to block using ipset. I have this bash script that essentially reads from the plain txt file and constructs an array. Then ...
0
votes
0answers
12 views

Is the functionality of libipset covered by CAP_NET_ADMIN?

The capabilities(7) states (excerpt): CAP_NET_ADMIN Perform various network-related operations: * interface configuration; * administration of IP firewall, masquerading, and accounting; ...
0
votes
0answers
836 views

Upon bootup, all iptables are lost because the kernel module ip_set is not loaded

i can get iptables to whitelist / blacklist using ipset members, but after a reboot, the iptables are emptied out because the kernel module is not loaded. Have limped along in the past by customizing ...
0
votes
1answer
247 views

APF firewall & IPset

Due to too many hack attempts from spam countries, today got the server configured with IPset for iptables. I loaded thousands of ip range in IPset & then added it to iptables with this command ...