Questions tagged [ipset]

ipset is administration tool for IP sets

Filter by
Sorted by
Tagged with
0
votes
1answer
21 views

iptables: drop any ip not on whitelist, short circuiting chain

I have a whitelist of ip addresses I'm storing in a ipset. I want to craft an iptables rule for my input chain where any IP NOT on the whitelist gets dropped immediately and no rules further down the ...
1
vote
0answers
25 views

how to change ipset set type?

I have an ipset in-use for my firewall. It was created using set-type "nethash". Turns-out this list will only contain individual ip addresses, making set-type "iphash" more ...
0
votes
0answers
14 views

Only enable conntrack for certain connections based on ipset - netfilter

I'm trying DNS traffic redirection setup based on IPSET. Basically, I need to do the DNAT for each IP listed in the IPSET, and at the same time, I need other connections not to track to minimize the ...
0
votes
0answers
106 views

Using IPSET to block country results in “ipset v6.34: Kernel support protocol versions 6-7 while userspace supports protocol versions 6-6”

I am having a VPS on amazon server. My kernel version of aws is: 5.3.0-1034-aws I have installed IPSET to block massive no. of IP's and IP Ranges to avoid connection to my server. But IPSET is giving ...
0
votes
0answers
31 views

How ipset timeout works?

Is the expiry checked for every received packet if the ip should be removed from ipset or is there something in the background running every second and removing expired ip addresses?
0
votes
0answers
39 views

How to read ip and port from text file and put in firewall

I decided to use iptables and ipset to read text file that contains source ip and destination port. I want to drop these flows. Is it possible and how to write command to perform this? The file is: ...
1
vote
1answer
186 views

Does upset hash:net,port support 0.0.0.0/0

Is there a way to add 0.0.0.0/0 to ipset type hash:net,port? It appears to only support prefix lengths of 1-32 but what if I want an entry in my ipset hash to support all ip traffic on a given port? ...
1
vote
1answer
294 views

iptables add ip,port and also IP

Now I perform this: create blockipset hash:ip add blockipset 192.168.1.5 -exist add blockipset 192.168.3.115 -exist Is it possible for iptables and ipset to block ip,port and ip? for example, the ...
0
votes
2answers
713 views

how to check whether an ipset was hooked up to iptables

My iptables output looks like this: Chain INPUT (policy ACCEPT) num target prot opt source destination 1 DROP all -- 0.0.0.0/0 0.0.0.0/0 ...
2
votes
1answer
2k views

How do I fix this error: “ipset v6.11: Hash is full, cannot add more elements”

When I run the update script for voipbl manually, I get this error from ipset: ipset v6.11: Hash is full, cannot add more elements. I am running it manually because some IPs that are on the blacklist ...
1
vote
1answer
514 views

Conntrack and dynamic ipset/iptables rules

I don't understand some basic concepts of conntrack module. First of all, I'm sure it's enabled in my system (Ubuntu 18.04), modinfo shows info about nf_conntrack and /proc/modules file tells ...
-1
votes
1answer
1k views

How to check multiple list from IPSet in IPTables with a single rule?

How can I check multiple list of IPs from IPSet in IPTables with a single rule? I need to add check two list of IPs because it is too big. I know it is not healthy, but I need to do it that way. ...
1
vote
2answers
1k views

ipset How to add IP range from x to y

I need to add this 81.212.0.0/14 ip range to ipset. But it doesnt calculate lower than /16. I want to add from 81.212.0.0 to 81.215.255.255 IP addresses. Is there any other way but /14. Im trying to ...
0
votes
1answer
154 views

ipset command's output not storing to variable

I am building a script to detect if IPSET exists. #!/bin/bash str=$(/usr/sbin/ipset test IPsetName 1.1.1.1) echo "$str" #outputs blank line if [[ $str = *"The set with the given name does not ...
1
vote
1answer
816 views

How do I whitelist an ip for a limited time?

I'm trying to create auto-whitelisting of IPs with a timeout based on certain events using firewalld and ipsets. This is how far I got firewall-cmd --permanent --new-ipset=whitelist --type=hash:ip --...
2
votes
1answer
1k views

Forward traffic to virtual interface based on source IP address dynamically using iptables

I'm experimenting DNS server setup that reply different results based on source IP address. and the same time I need to dynamically change what interface external source ip should forward, eth0 ...
0
votes
1answer
193 views

IPset and making firewall simple

I've got many rules like: -A POSTROUTING -s IP_LOCAL1 -j SNAT --to-source IP_PUBLIC1 -A POSTROUTING -s IP_LOCAL2 -j SNAT --to-source IP_PUBLIC2 ... ... -A POSTROUTING -s IP_LOCAL100 -j SNAT --to-...
3
votes
3answers
7k views

How to import multiple ip's to Ipset?

I am using iptables with ipset on an Ubuntu server firewall. I am wondering if there is a command for importing a file containg a list of ip's to ipset. To populate an ipset, right now, I am adding ...
0
votes
1answer
618 views

How to block certain protocols with ipset?

The thing is, I currently have 3 virtual test machines, Client1, ip 192.168.1.10, Client2, ip 192.168.2.20 and Router with ip 192.168.1.1 and 192.168.2.1 as gateway to connect Client1 and Client2. On ...
0
votes
1answer
245 views

IPSET matching unavailable for one linux installation, but not another… and only IPv4 is affected [closed]

I have two Ubuntu 16.04 servers, one on a little intel atom itx box on my local network and one hosted as a VPS. Both were installed fresh within the last week. Both are generally the same ...
2
votes
0answers
401 views

with firewalld is it possible to use an invert ipset as source?

with firewalld I can make a rule like this: (note the invert="True") firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="192.168.100.0/24" invert="True" drop' and I can ...
3
votes
1answer
2k views

how to addfile to ipset in shell script?

This is my ipset shell script file like this #!/bin/bash for IP in $(wget -O /var/geoiptest.txt http://www.ipdeny.com/ipblocks/data/countries/{ad,ae,af}.zone) do # ban everything - block country sudo ...
2
votes
0answers
392 views

Match-set via libiptc

Could anyone share any examples that use match-set for iptables via the libiptc library? I have tried using the iptables v1.4.21 and the code from https://bani.com.br/2012/05/programmatically-...
2
votes
1answer
2k views

RHEL: can't use ipset utility with error: cannot open session to kernel

I'm using a VPS from a VPS provider that run a 2.6 kernel, RHEL with OpenVZ virtualization system. I want to use ipset utility to manage ip sets on my iptables firewall. This is the error I'm getting ...
2
votes
0answers
315 views

Meaning of “Revision” in ipset output

With iptables version 1.4.21 and RHEL7.2 and ipset v6.19, I have been observing a difference in ipsets. It seems that the ipsets are displayed as follows:- root@system> ipset list Name: ...
1
vote
1answer
880 views

ipset v4.5: Unknown set type

I compiled ipset on CentOS5 32bit machine and i am getting weird errors My kernel: [root@localhost ipset-4.5]# uname -a Linux localhost.localdomain 2.6.18-400.1.1.el5 #1 SMP Thu Dec 18 00:58:32 EST ...
1
vote
0answers
2k views

Change timeout of an entry of ipset with iptables rule

I'm trying to create a set with ipset and using it in some iptables rules. ipset has timeout option to set a countdown timeout to an entry of a set to automatically remove it after a period of time. ...
1
vote
1answer
5k views

How to match properly against an IP set of type 'hash:ip,port'?

My current setup is that I have a server with several IPv4 addresses. Let's ignore the IPv6 part for now, as the symptoms are identical there. In the firewall rules I'd like to match against HTTP ...
4
votes
1answer
1k views

How to combine connlimit with IP sets?

connlimit lets me limit the number of connections per client/service. How would I go about to combine such a rule with the IP sets available in more recent versions of the Linux kernel and netfilter?
0
votes
0answers
2k views

Upon bootup, all iptables are lost because the kernel module ip_set is not loaded

i can get iptables to whitelist / blacklist using ipset members, but after a reboot, the iptables are emptied out because the kernel module is not loaded. Have limped along in the past by customizing ...
6
votes
1answer
4k views

Is there a way to match an inet and inet6 IP set in a single rule?

Is it possible to have one IPv4 and one IPv6 IP set (ipset(8)) within the same rule? I have several rules that depend on one set of IPv4 addresses and another set of IPv6 addresses respectively, but ...
5
votes
2answers
3k views

Can iptables rules manipulate IP sets?

In iptables-extensions(8) the set module is described and it is discussed that it is possible to react to the presence or absence of an IP or more generally a match against an IP set. However, it ...
5
votes
1answer
2k views

How can I let ipset entries “age”?

I am trying to establish a whitelist of clients that have successfully logged into the system, using ipset. What options do I have to let an entry age so that I can later discard it based on its age? ...
2
votes
1answer
1k views

Do I have to swap IP sets, or can I add/remove on the fly?

I was wondering about the semantics of ipset(8). Is it possible to add a rule matching a set to iptables and then manipulate the set, or can I only create a set and swap it for an older set in order ...
2
votes
0answers
2k views

What alternatives are there to ipset for blocking large sets of ip addresses / address ranges?

Are there alternatives to ipset that offer similar efficiency in handling large sets of ip addresses or ip address ranges? We originally used iptables to selectively block access to our servers for ...
0
votes
2answers
579 views

APF firewall & IPset

Due to too many hack attempts from spam countries, today got the server configured with IPset for iptables. I loaded thousands of ip range in IPset & then added it to iptables with this command ...
2
votes
2answers
316 views

ipset accounting information

I know that iptables keeps accounting information for ip traffic blocked or passed. However, it appears that when using ipsets with iptables, the accounting information is aggregated for the entire ...
3
votes
2answers
6k views

iptables… blocking a range without flooding ipset set with IPs

I have this range of IPS 197.192.x.x that is brute force attacking my pop/imap/smtp servers day after day. I have this ipset in place that is blocking every IP that tries to hack on my server. I ...
1
vote
2answers
2k views

iptables and logs

Suppose I add an IP to iptables blocking for exim, dovecot and FTP and this IP visits my server again. Is there any log of this visit so I can confirm the IP was trying to reach the server again but ...
7
votes
4answers
25k views

iptables rules not reloading on CentOS 6.x

I have one single ipset added to my iptables on a CentOS 6.x box and this rule is lost when the machine reboots. I've found this answer showing how to make a Ubuntu system reload the iptables rules ...
2
votes
1answer
2k views

iptables is not blocking

I have a script running every minute by a crontab. This script scans the system logs and grabs the IPs of every failed attempt to login on the server's dovecot, exim or ssh and add them to an ipset, ...
0
votes
1answer
1k views

IP set to block access to exim and dovecot

I have created a ipset with a bunch of IPs that I want to block access to dovecot and exim. The ipset is called "bannedIPs" and have been added to iptables using this iptables -A INPUT -p tcp --...
1
vote
2answers
1k views

ipset not executing from crontab

I have this txt files that contains IPs, one per line of file, that I want to block using ipset. I have this bash script that essentially reads from the plain txt file and constructs an array. Then ...
2
votes
1answer
298 views

Using iptables to block for specific services

I am using ipset in conjunction with iptables to create a list of IPs I want to block. I did this: ipset -N blocking iphash ipset -A blocking 124.205.11.230 // and repeated this line for all IPs I ...