Server Fault Stack Exchange
Server Fault Stack Exchange

Questions tagged [ipset]

IP sets is a Linux kernel framework to effectively store and manage sets of IP addresses and/or network interfaces.

46 questions
0
votes
1 answer

IP white list for docker containers with iptables and ipset

I want to restrict access to docker container ports just from specified IPs. I set up iptables rules with ipset. I have exposed the port 8888. The requests from port 8888 are forwarded to simple docker web server. I defined ipset with white list IP…
misco
  • 101
  • 3
0
votes
2 answers

replacing a runtime instance of ipset

I have a running instance of iptables and ipset services. Among them one set has a spec similar to this that has 20+ references to it: create_set foo ipmap --network 123.45.67.0/24 add_to_set foo host1 add_to_set foo host2 where host1 and 2 are say…
Serguei
  • 127
  • 9
0
votes
1 answer

iptables ipset misconfiguration?

I'm looking for a solid method to block unwanted TCP/IP traffic. On my linux machine iptables and ipset seem to offer a nice way to do so. Until now I've done this: ipset create ipsok hash:net maxelem (result of wc -l for my cidr list in a…
Karel de V
  • 1
0
votes
1 answer

no package ipset available (centos EL5 x86_64)

I want to install ipset, but none of my repos seem to have it when I run yum install ipset [root@ora1 /]# cd /etc/yum.repos.d/ [root@ora1 yum.repos.d]# ls CentOS-Base.repo CentOS-Debuginfo.repo CentOS-Media.repo CentOS-Vault.repo …
user584583
  • 109
  • 1
  • 6
0
votes
1 answer

fail2ban ipset proper setup of jail.conf

My understanding is that running Fail2ban using ipset is faster. To that end: I downloaded and installed per instructions (modified for Fedora 37) ritsu/ipset-fail2ban from Git. My banaction is still set as: banaction_allports =…
WSpivak
  • 3
  • 2
0
votes
1 answer

Having trouble with ipset behaviour

Have a script to populates ipsets and then I do: /sbin/iptables -I INPUT -m set --match-set ipsum src -j DROP Now not sure how this works out for other ports but I know that if I want the addresses included in "ipsum" not to access 80 and 443 i have…
airdogvan
  • 1
  • 1
0
votes
1 answer

firewalld apply interface zone after ipset zone match

I have a firewalld setup with two zones. One zone, some-ips-allowed, is used to permit traffic from specific IP networks on some ports: some-ips-allowed (active) target: default icmp-block-inversion: no interfaces: sources:…
rubikonx9
  • 101
  • 3
0
votes
1 answer

How can I organize the IPs/CIDR when executing restore ipset?

I have this bash script of ipset v7.15 (run in ubuntu 22.04), courtesy of Martin (that I have made some modifications for this question): ipset create -! blacklist hash:net family inet hashsize 1024 ipset save -! > /tmp/ipset.txt cat list.txt |…
acgbox
  • 376
  • 1
  • 5
  • 21
0
votes
1 answer

how to add multiples ips cidr with ipset save and restore options

i have this loop to block IPs and CIDR with ipset/iptables: # this is just an example. the actual list IPs/CIDR is very large cat blockip.txt 13.31.0.254 cat blockcidr.txt 13.32.0.0/15 Loop: #!/bin/bash ipset -F ipset -N -! blacklist hash:net…
acgbox
  • 376
  • 1
  • 5
  • 21
0
votes
0 answers

Is there a way to capture packages by using tcpdump with ipset?

I got a big ipset and I want to capture networking packages related/not-related to these IPs. Is there a way to capture packages by using tcpdump with ipset as param?
Catscarlet
  • 101
  • 2
0
votes
0 answers

how to block ipv4 list with iptables/ipset, but exclude certain ports

I have the following rules in a bash (in that order): # blocklist.txt contains: #192.168.1.39 for ip in $(cat blocklist.txt); do iptables -I INPUT -s $ip -p tcp -m multiport --dports 137:139,445 -j ACCEPT iptables -I FORWARD -d $ip -p tcp…
acgbox
  • 376
  • 1
  • 5
  • 21
0
votes
0 answers

nftables or fw4 issue with timebased traffic rules

Since the OpenWRT ver > 22.3 does use NFTABLES instead of IPTABLES I got issue with some firewall (fw4) time based traffic rules that I have no idea how to solve them. The firewall rule is as follows config rule option name 'Block-Traffic' …
Sina S.
  • 11
  • 1
  • 2
0
votes
1 answer

Shorewall: IPSet from blrules not applying

We're hoping to make use of IPSet to manage temporary IP blocking from sources (CSF+LFD, fail2ban, wherever relevant). The purpose would be that routers using Shorewall at the edges would make use of these to block traffic from malicious remotes…
Adambean
  • 153
  • 1
  • 1
  • 9
0
votes
0 answers

Addresses not always added to set (iptables)

We use iptables with ipset lists on our network boundary. Generally this works well. I have updated the rules to catch more activity and found that a rule to update a set does not always seem to successfully update the set. The rule is in the…
Rob Lambden
  • 260
  • 2
  • 6
0
votes
1 answer

Allow only SYN packets to port 80 matching an ipset

I have an ipset named allowList. I want to allow every connection to my machine on every port but port 80, which there I want to allow connections only to the ipset: allowList. I want to target only the SYN packets from port 80 for efficiency, so…
iTaMaR
  • 1
1 2
3
4