LinuxQuestions.org
Review your favorite Linux distribution.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 01-13-2021, 06:14 AM   #1
sniper8752
Member
 
Registered: Oct 2012
Posts: 564

Rep: Reputation: Disabled
iptables and ipset lists


How do I create ipset lists before iptables is restored on machine start up? Right now, when I start up my server, iptables rules fail to load because the ipset lists do not exist that are referred to in iptables rules.
 
Old 01-14-2021, 12:30 AM   #2
astrogeek
Moderator
 
Registered: Oct 2008
Distribution: Slackware [64]-X.{0|1|2|37|-current} ::12<=X<=15, FreeBSD_12{.0|.1}
Posts: 6,263
Blog Entries: 24

Rep: Reputation: 4194Reputation: 4194Reputation: 4194Reputation: 4194Reputation: 4194Reputation: 4194Reputation: 4194Reputation: 4194Reputation: 4194Reputation: 4194Reputation: 4194
Your question answers itself... "create ipset lists before iptables is restored".

The ipset sets must exist before any rules which reference them can be added, as you are aware. They can be empty and populated later, but they must exist. So as you want to do this at boot time arrange your init system to run your ipset create scripts before loading the iptables rules. How that is done is distro specific and subject to much variation/customization.

To get more specific help on how you may do that you should at least provide a better description including your distro, how your iptables rules are initialized, how your ipsets are created and populated, etc.
 
1 members found this post helpful.
Old 01-16-2021, 02:41 AM   #3
oswerks
LQ Newbie
 
Registered: Nov 2019
Posts: 11

Rep: Reputation: Disabled
Try a script with something like this:
Code:
ipset create some_ipset_to_drop hash:net
for i in $(cat /path/on/a/disk/to/someiplist.file ); do ipset -A some_ipset_to_drop $i; done
/sbin/iptables-restore < /path/on/a/disk/to/firewall_rules.file
File with addresses to block is required. Or create empty sets to populate later.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Can't execute otherwise working script at startup for ipset and iptables with systemd chrisknight Linux - Security 9 02-17-2019 04:19 PM
[SOLVED] iptables/ipset configuration with hashlimit/limit not behaving properly freeindy Linux - Security 1 03-06-2014 06:29 AM
[SOLVED] ipset and iptables - recompile iptables? Habitual Linux - Server 2 02-19-2014 08:12 AM
iptables / ipset, redirect a set to another host/ip? i5050net Linux - Networking 1 09-16-2013 01:06 PM
LXer: Unique Sorting Of Lists And Lists Of Lists With Perl For Linux Or Unix LXer Syndicated Linux News 0 09-05-2008 01:50 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 02:35 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration