0

i can get iptables to whitelist / blacklist using ipset members, but after a reboot, the iptables are emptied out because the kernel module is not loaded. Have limped along in the past by customizing the iptables init script, but there has to be an out-of-the-box method.

On CentOS/RHEL 6.5, you can install ipset from the base repository. The first line from

yum info
says

IP sets are a framework inside the Linux 2.4.x and 2.6.x kernel, which can be : administered by the ipset utility.

so i was surprised there is a problem with a kernel module:

ip6tables: Loading additional modules: nf_conntrack_netbios_ns ... OK
iptables: Applying firewall rules: iptables-restore v1.4.7: Kernel module ip_set 
is not loaded in.

i have tried both ip-set and ip_set for this module name with no luck:

/etc/sysconfig/iptables-config:
   IPTABLES_MODULES="nf_conntrack_netbios_ns ip_set"

There may also be separate modules for each ipset data structure. In other words, a module just for ipset hash versus ipset bitmap versus ipset list.

modinfo ip_set and other details

  • Did you try modprobe ip_set? – cuonglm Aug 10 '14 at 15:36
  • @Gnouc, yes but where would you put that at startup? i can get iptables to block based on members of an ipset but not after reboot. i am trying to get away from /etc/init.d/rc.local and other hacks. – rjt Aug 10 '14 at 15:48
  • What did you mean other hacks? On Centos/Fedora, you can use /etc/modules-load.d. On Debian/Ubuntu, use /etc/modules. See: wiki.archlinux.org/index.php/kernel_modules#Loading – cuonglm Aug 10 '14 at 15:58
  • There is not a /etc/modules-load.d file or directory on my system. Other hacks such as modifying /etc/init.d/iptables to call a script which sets up ipsets and loads the modules THEN loads iptables. – rjt Aug 10 '14 at 16:09
  • What is your OS? – cuonglm Aug 10 '14 at 16:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.