0

i can get iptables to whitelist / blacklist using ipset members, but after a reboot, the iptables are emptied out because the kernel module is not loaded. Have limped along in the past by customizing the iptables init script, but there has to be an out-of-the-box method.

On CentOS/RHEL 6.5, you can install ipset from the base repository. The first line from

yum info
says

IP sets are a framework inside the Linux 2.4.x and 2.6.x kernel, which can be : administered by the ipset utility.

so i was surprised there is a problem with a kernel module:

ip6tables: Loading additional modules: nf_conntrack_netbios_ns ... OK
iptables: Applying firewall rules: iptables-restore v1.4.7: Kernel module ip_set 
is not loaded in.

i have tried both ip-set and ip_set for this module name with no luck:

/etc/sysconfig/iptables-config:
   IPTABLES_MODULES="nf_conntrack_netbios_ns ip_set"

There may also be separate modules for each ipset data structure. In other words, a module just for ipset hash versus ipset bitmap versus ipset list.

modinfo ip_set and other details

11
  • Did you try modprobe ip_set?
    – cuonglm
    Aug 10, 2014 at 15:36
  • @Gnouc, yes but where would you put that at startup? i can get iptables to block based on members of an ipset but not after reboot. i am trying to get away from /etc/init.d/rc.local and other hacks.
    – rjt
    Aug 10, 2014 at 15:48
  • What did you mean other hacks? On Centos/Fedora, you can use /etc/modules-load.d. On Debian/Ubuntu, use /etc/modules. See: wiki.archlinux.org/index.php/kernel_modules#Loading
    – cuonglm
    Aug 10, 2014 at 15:58
  • There is not a /etc/modules-load.d file or directory on my system. Other hacks such as modifying /etc/init.d/iptables to call a script which sets up ipsets and loads the modules THEN loads iptables.
    – rjt
    Aug 10, 2014 at 16:09
  • What is your OS?
    – cuonglm
    Aug 10, 2014 at 16:12

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.