Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [ipset]

ipset is administration tool for IP sets

-1
votes
1answer
52 views

How to check multiple list from IPSet in IPTables with a single rule?

How can I check multiple list of IPs from IPSet in IPTables with a single rule? I need to add check two list of IPs because it is too big. I know it is not healthy, but I need to do it that way. ...
1
vote
2answers
68 views

ipset How to add IP range from x to y

I need to add this 81.212.0.0/14 ip range to ipset. But it doesnt calculate lower than /16. I want to add from 81.212.0.0 to 81.215.255.255 IP addresses. Is there any other way but /14. Im trying to ...
0
votes
1answer
68 views

ipset command's output not storing to variable

I am building a script to detect if IPSET exists. #!/bin/bash str=$(/usr/sbin/ipset test IPsetName 1.1.1.1) echo "$str" #outputs blank line if [[ $str = *"The set with the given name does not ...
0
votes
0answers
175 views

How big should I make my ipset list:set?

As noted in the manual, the default size of list:set is 8. Mostly this is enough, but sometimes I have more items to put in my list. It is not easy to predict how many items I will have over the life ...
1
vote
1answer
474 views

How do I whitelist an ip for a limited time?

I'm trying to create auto-whitelisting of IPs with a timeout based on certain events using firewalld and ipsets. This is how far I got firewall-cmd --permanent --new-ipset=whitelist --type=hash:ip --...
1
vote
1answer
448 views

Forward traffic to virtual interface based on source IP address dynamically using iptables

I'm experimenting DNS server setup that reply different results based on source IP address. and the same time I need to dynamically change what interface external source ip should forward, eth0 ...
0
votes
1answer
141 views

IPset and making firewall simple

I've got many rules like: -A POSTROUTING -s IP_LOCAL1 -j SNAT --to-source IP_PUBLIC1 -A POSTROUTING -s IP_LOCAL2 -j SNAT --to-source IP_PUBLIC2 ... ... -A POSTROUTING -s IP_LOCAL100 -j SNAT --to-...
0
votes
3answers
2k views

How to import multiple ip's to Ipset?

I am using iptables with ipset on an Ubuntu server firewall. I am wondering if there is a command for importing a file containg a list of ip's to ipset. To populate an ipset, right now, I am adding ...
0
votes
1answer
368 views

How to block certain protocols with ipset?

The thing is, I currently have 3 virtual test machines, Client1, ip 192.168.1.10, Client2, ip 192.168.2.20 and Router with ip 192.168.1.1 and 192.168.2.1 as gateway to connect Client1 and Client2. On ...
0
votes
1answer
150 views

IPSET matching unavailable for one linux installation, but not another… and only IPv4 is affected [closed]

I have two Ubuntu 16.04 servers, one on a little intel atom itx box on my local network and one hosted as a VPS. Both were installed fresh within the last week. Both are generally the same ...
2
votes
0answers
286 views

with firewalld is it possible to use an invert ipset as source?

with firewalld I can make a rule like this: (note the invert="True") firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="192.168.100.0/24" invert="True" drop' and I can ...
3
votes
1answer
1k views

how to addfile to ipset in shell script?

This is my ipset shell script file like this #!/bin/bash for IP in $(wget -O /var/geoiptest.txt http://www.ipdeny.com/ipblocks/data/countries/{ad,ae,af}.zone) do # ban everything - block country sudo ...
2
votes
0answers
319 views

Match-set via libiptc

Could anyone share any examples that use match-set for iptables via the libiptc library? I have tried using the iptables v1.4.21 and the code from https://bani.com.br/2012/05/programmatically-...
2
votes
1answer
1k views

RHEL: can't use ipset utility with error: cannot open session to kernel

I'm using a VPS from a VPS provider that run a 2.6 kernel, RHEL with OpenVZ virtualization system. I want to use ipset utility to manage ip sets on my iptables firewall. This is the error I'm getting ...
2
votes
0answers
232 views

Meaning of “Revision” in ipset output

With iptables version 1.4.21 and RHEL7.2 and ipset v6.19, I have been observing a difference in ipsets. It seems that the ipsets are displayed as follows:- root@system> ipset list Name: ...
1
vote
1answer
715 views

ipset v4.5: Unknown set type

I compiled ipset on CentOS5 32bit machine and i am getting weird errors My kernel: [root@localhost ipset-4.5]# uname -a Linux localhost.localdomain 2.6.18-400.1.1.el5 #1 SMP Thu Dec 18 00:58:32 EST ...
1
vote
0answers
1k views

Change timeout of an entry of ipset with iptables rule

I'm trying to create a set with ipset and using it in some iptables rules. ipset has timeout option to set a countdown timeout to an entry of a set to automatically remove it after a period of time. ...
1
vote
1answer
3k views

How to match properly against an IP set of type 'hash:ip,port'?

My current setup is that I have a server with several IPv4 addresses. Let's ignore the IPv6 part for now, as the symptoms are identical there. In the firewall rules I'd like to match against HTTP ...
3
votes
1answer
1k views

How to combine connlimit with IP sets?

connlimit lets me limit the number of connections per client/service. How would I go about to combine such a rule with the IP sets available in more recent versions of the Linux kernel and netfilter?
0
votes
0answers
2k views

Upon bootup, all iptables are lost because the kernel module ip_set is not loaded

i can get iptables to whitelist / blacklist using ipset members, but after a reboot, the iptables are emptied out because the kernel module is not loaded. Have limped along in the past by customizing ...
6
votes
1answer
3k views

Is there a way to match an inet and inet6 IP set in a single rule?

Is it possible to have one IPv4 and one IPv6 IP set (ipset(8)) within the same rule? I have several rules that depend on one set of IPv4 addresses and another set of IPv6 addresses respectively, but ...
5
votes
2answers
2k views

Can iptables rules manipulate IP sets?

In iptables-extensions(8) the set module is described and it is discussed that it is possible to react to the presence or absence of an IP or more generally a match against an IP set. However, it ...
5
votes
1answer
2k views

How can I let ipset entries “age”?

I am trying to establish a whitelist of clients that have successfully logged into the system, using ipset. What options do I have to let an entry age so that I can later discard it based on its age? ...
2
votes
1answer
897 views

Do I have to swap IP sets, or can I add/remove on the fly?

I was wondering about the semantics of ipset(8). Is it possible to add a rule matching a set to iptables and then manipulate the set, or can I only create a set and swap it for an older set in order ...
2
votes
0answers
2k views

What alternatives are there to ipset for blocking large sets of ip addresses / address ranges?

Are there alternatives to ipset that offer similar efficiency in handling large sets of ip addresses or ip address ranges? We originally used iptables to selectively block access to our servers for ...
0
votes
2answers
523 views

APF firewall & IPset

Due to too many hack attempts from spam countries, today got the server configured with IPset for iptables. I loaded thousands of ip range in IPset & then added it to iptables with this command ...
2
votes
2answers
270 views

ipset accounting information

I know that iptables keeps accounting information for ip traffic blocked or passed. However, it appears that when using ipsets with iptables, the accounting information is aggregated for the entire ...
3
votes
2answers
4k views

iptables… blocking a range without flooding ipset set with IPs

I have this range of IPS 197.192.x.x that is brute force attacking my pop/imap/smtp servers day after day. I have this ipset in place that is blocking every IP that tries to hack on my server. I ...
1
vote
2answers
1k views

iptables and logs

Suppose I add an IP to iptables blocking for exim, dovecot and FTP and this IP visits my server again. Is there any log of this visit so I can confirm the IP was trying to reach the server again but ...
7
votes
4answers
22k views

iptables rules not reloading on CentOS 6.x

I have one single ipset added to my iptables on a CentOS 6.x box and this rule is lost when the machine reboots. I've found this answer showing how to make a Ubuntu system reload the iptables rules ...
2
votes
1answer
2k views

iptables is not blocking

I have a script running every minute by a crontab. This script scans the system logs and grabs the IPs of every failed attempt to login on the server's dovecot, exim or ssh and add them to an ipset, ...
0
votes
1answer
947 views

IP set to block access to exim and dovecot

I have created a ipset with a bunch of IPs that I want to block access to dovecot and exim. The ipset is called "bannedIPs" and have been added to iptables using this iptables -A INPUT -p tcp --...
1
vote
2answers
1k views

ipset not executing from crontab

I have this txt files that contains IPs, one per line of file, that I want to block using ipset. I have this bash script that essentially reads from the plain txt file and constructs an array. Then ...
2
votes
1answer
264 views

Using iptables to block for specific services

I am using ipset in conjunction with iptables to create a list of IPs I want to block. I did this: ipset -N blocking iphash ipset -A blocking 124.205.11.230 // and repeated this line for all IPs I ...