1

When I run the update script for voipbl manually, I get this error from ipset: ipset v6.11: Hash is full, cannot add more elements. I am running it manually because some IPs that are on the blacklist seem to still be getting through the firewall. From the man pages for ipset it would seem to have something to do with increasing the hash size, or the maximum number of elements, but neither of those seem to work for me.

Here is the listing for the set:

CommandMe-> ipset voipbl -l
    Name: voipbl
    Type: hash:ip
    Header: family inet hashsize 2048 maxelem 200000
    Size in memory: 16460
    References: 1
    Members:

This appears to be how many addresses made it into the set:

CommandMe-> ipset -l |wc -l
65549

The manual says the default maximal number of elements which can be stored in the set is 65536. I seem to be going over that limit, but cannot get more than 65549 elements in.

I've got about 80000 addresses in the blacklist. Am I getting this error because ipset was unable to store the remaining IPs (65550-80000) in the hash? Can someone please point me in the right direction? Thanks!

  • Did you install Fail2ban and otherwise follow the instructions at voipbl.org/#install in sequence? – K7AAY Jun 6 at 21:41
  • Could you confirm syntax. I'm using ipset v.6.38 and that doesn't have a -l switch, it does have a -L switch. If you are using ipset -L | wc -l to count entries, then don't. Use ipset -L voipbl | grep 'Number of entries'. I've also confirmed that on ipset v6.38 kernel 4.19.42 that a hash:ip set of size 200,000 can store at least 81,494 records. – Philip Couling Jun 7 at 11:12
  • I'm using ipset v6.11, protocol version: 6 Philip. I see no difference in the output for -l and -L. This is however on a server using kernel 2.6.32 . – d10nte Jun 7 at 12:42
  • Yes, I installed following the instructions verbatim, in sequence. I've also destroyed and recreated the set, and restarted fail2ban/ipset/iptables. – d10nte Jun 7 at 12:44
  • Guys I figure it out. The voipbl script includes this line: ipset create voipbl_temp hash:ip and also ipset swap voipbl_temp voipbl; ipset destroy voipbl_temp || true The change needed to be made to the line that creates the voipbl_temp ipset. Thanks everyone for your help! – d10nte Jun 10 at 15:34
1

The voipbl script includes this line: ipset create voipbl_temp hash:ip and also:

ipset swap voipbl_temp voipbl
ipset destroy voipbl_temp || true 

The change in hash size/maximum elements needed to be made to the line that creates the voipbl_temp ipset.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.