I made a very simple bash script (echo at start, runs commands, echos at end) to add approx 7300 rules to iptables blocking much of China and Russia, however it gets through adding approximately 400 rules before giving the following error for every subsequent attempt to add a rule to that chain:

iptables: Unknown error 18446744073709551615

I even tried manually adding rules afterwards and it won't let me add them (it gives the same error).

The command to add each rule looks like this:

/sbin/iptables -A sshguard -s x.x.x.0/x -j DROP

sshguard is a chain I created for use with the sshguard daemon, and I wanted to add the rules there so I wasn't muddying up the INPUT chain. The ip ranges I am supplying are not to blame here, as I have supplied valid ranges to test and they are met with the same error. Flushing the chain of rules and adding individual ones work, but again, not after ~400 entries.

I did some googling beforehand, but the others having this issue don't seem to be having it for the same reasons I am.

Is there some kind of rule limit per chain with iptables? Also, is this the proper way to go about blocking these ranges (errors aside)?

# iptables -V
iptables v1.3.5

# cat /etc/issue
CentOS release 5.8 (Final)

# uname -a 
Linux domain.com 2.6.18-028stab101.1 #1 SMP Sun Jun 24 19:50:48 MSD 2012 x86_64 x86_64 x86_64 GNU/Linux

Edit: To clarify, the bash script is running each iptables command individually, not looping through a file or list of IPs.

Also, my purpose for blocking these ranges is preventative -- I am trying to limit the amount of bots that scrape, crawl, or attempt to create spam accounts on a few of my websites. I am already using sshguard to block brute force attempts on my server, but that does not help with the other bots, obviously.

  • Learn about the NFQUEUE target and use nfblock. Much more elegant. – LawrenceC Jan 29 '13 at 4:14
  • Does that work on CentOS 5.x without recompiling the kernel? – Brendan Jan 29 '13 at 4:20
  • if your kernel has NFQUEUE target support built-in or available as a module then no kernel recompile needed. You'll need to compile nfblock though unless you find an .rpm for it. NFQUEUE was introduced with 2.6.14. – LawrenceC Jan 29 '13 at 22:21
  • This is what IP Sets are for. – derobert Oct 4 '13 at 14:50

OK, I figured it out.

I should have mentioned that I had a Virtuozzo container for my VPS. http://kb.parallels.com/en/746 mentions the following:

Also it might be required to increase numiptent barrier value to be able to add more iptables rules:

~# vzctl set 101 --save --numiptent 400

FYI: The container has to be restarted for this to take effect.

This explains why I hit the limit at around 400. If I had CentOS 6, I would install the ipset module (EPEL) for iptables instead of adding all these rules (because ipset is fast).

As it stands now, on CentOS 5.9, I'd have to compile iptables > 1.4.4 and my kernel to get ipset. Since this is a VPS and my host may eventually upgrade to CentOS 6, I am not going to pursue that.


It's not hard to debug, but if you convert the rules to pure iptables commands, and execute them one by one (use a shell script), you'd see the errors, normally would be missing of some ipt modules.

First use iptables-save to export current rules, then do something like this to debug that line-by-line:

egrep '^(-A|-I)' ok.rules | while read x; do iptables $x || { echo failed $x; break; }; done

I googled a bit, it seems to be a bug on CentOS's default kernel config.

  • That's what I did. Like I said, it was a very simple bash script; I had ~7300 lines that looked just like the example I gave. All the iptables commands after ~400 give the same "unknown error". I ran service iptables save before executing the script, so it was simple to revert using service iptables restart. If it's a bug in CentOS' kernel config, I'm not sure there's much I can do about that given that it's a virtual dedicated server (can't do kernel modifications, afaik). – Brendan Nov 5 '12 at 3:35

There looks to be an open bug in RHEL regarding iptables.. You might be hitting it. https://bugzilla.redhat.com/show_bug.cgi?id=598380

In the mean time, have you looked at something like denyhosts ? It will automatically add entries to hosts.deny as you are attacked (ssh attacks)

Just a thought.

  • I use sshguard (www.sshguard.net) to block attacks dynamically. I looked into fail2ban and denyhosts, but those would be redundant with sshguard running. That said, the main issue is that I want to block these IP ranges preemptively, because of crawlers and scrapers in those regions. – Brendan Nov 5 '12 at 3:31

For a large or a considerable range of ip's my recommendation for you is use ipset

If want to block an entire country ip block you can use the geoip module for iptables.

  • If you read my answer, in this particular instance ipset was not an option. If it was, I would have used it. I have since switched VPS providers and use ipset now. – Brendan Mar 30 '15 at 13:42
  • Yes I know but independently of your answer I would insist on this because is the most typical implementation if you want to block a huge range or a huge amount of ip's... On the other hand, I was reading your article again and I was wondering probably you don't need to use iptables to block the spam account creation and crawlers. To perform that is better if you use a web proxy, like Nginx or haproxy or even a WAF. In my opinion this kind of software is more accurate for this kind of task. Another option is use the "string" module for iptables: spamcleaner.org/en/misc/w00tw00t.html – Francis Mar 31 '15 at 10:38
  • I was blocking china because of bruteforce ssh login attempts--so haproxy nor nginx would have helped. Also recompiling the kernel was not an option as I did not have control over it on my vps. Hence why I was unable to use ipset in the first place. For what it is worth, the provider I was using was MediaTemple which still has not moved away from virtuozzo. – Brendan Mar 31 '15 at 13:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.