ipset-init: Add ipset to the DAEMONS array

drcouzelis · 2011-11-23 03:50:58

Edit: As of 10 May 2012 this package is no longer needed.

I started using ipset to block a list of known malicious IP addresses. I was disappointed to find out that:

A) There hardly any current information on the Internet about how to use the current version of ipset. I decided to start a page in the Arch Wiki for it. Also, the ipset man page is quite good.

B) There doesn't seem to be a standard way to store my ipset settings and load them at startup.

So, I created a super tiny weeny little package called ipset-init. It's designed to match nicely with the iptables configuration.

To use it, configure ipset how you'd like it, then call:

/etc/rc.d/ipset save

To load your configuration at startup, add "ipset" to your DAEMONS array, just before "iptables". That way, the sets you loaded with ipset can be loaded with iptables.

Please let me know if you have any suggestions for it.

Yes, I understand that there's more text in this post than there is in the actual package.

Last edited by drcouzelis (2012-05-11 00:36:09)

llawwehttam · 2011-11-25 04:01:48

Interesting. Your package may entice me to come back from using ufw.

drcouzelis · 2012-05-11 00:35:35

Update: This package is no longer needed. It's now part of the official "ipset" package.

MOVIN ON UPSTREAM AWWW YEAH

fukawi2 · 2012-05-11 22:28:17

ipset for has been around for a while and I'm surprised how slowly it has been adopted.... It solves some simple problems in a simple way.

fail2ban with a custom action script, combined with some dumb rules in iptables makes for an easily managed blacklist:

-A INPUT -p tcp -m tcp --dport 23 -j SET --add-set blacklist src 
-A INPUT -p tcp -m tcp --dport 1433 -j SET --add-set blacklist src 
-A INPUT -p tcp -m tcp --dport 3306 -j SET --add-set blacklist src

Arch Linux

#1 2011-11-23 03:50:58

ipset-init: Add ipset to the DAEMONS array

#2 2011-11-25 04:01:48

Re: ipset-init: Add ipset to the DAEMONS array

#3 2012-05-11 00:35:35

Re: ipset-init: Add ipset to the DAEMONS array

#4 2012-05-11 22:28:17

Re: ipset-init: Add ipset to the DAEMONS array

Board footer