Due to too many hack attempts from spam countries, today got the server configured with IPset for iptables.

I loaded thousands of ip range in IPset & then added it to iptables with this command

iptables -A INPUT -m set --set Cblock src -j DROP

Cblock is the name I gave for the ipset rule containing 20 countries ip range

All is good! but the moment I start APF firewall, ipset rules no longer in effect even though it still shows up in the status.

service iptables status

I checked APF config file & there is no mention about IPset. I also tried to start APF first & then load IPset rules. This approach also did not make a difference.

Anyone had similar circumstance to tackle? I use APF to deal with spamhouse ip's, port blocking etc.

Is there any other firewall wrapper that is compatible with IPset?


I'm pretty sure this is not related to ipset at all.

If you have any manual configuration in iptables, APF simply replaces them with their own rules.

Use iptables -L to check if your rule is still present and reachable.

Starting APF first and adding your rule afterwards should work. Be aware that iptable -A adds a rule at the end after all the other rules. If APF accepts the connection, your rule will never be reached. Use iptables -I to insert a rule at the beginning.

|improve this answer|||||

Type ipset --list and see what is in the list.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.