Home / server / Questions / 427308
Accepted
rubo77
Asked: 2012-09-14 16:51:33 +0800 CST

Howto use ipset and iptables on Ubuntu 12.04 to block lots of IPs

  • 772

I would like to use this tutorial: http://www.jsimmons.co.uk/2010/06/08/using-ipset-with-iptables-in-ubuntu-lts-1004-to-block-large-ip-ranges/

In Ubuntu 12.04 the package ipset-source is removed from the repository I guess that's why I only get an error when I try installing it like this:

apt-get install module-assistant ipset
m-a a-i ipset

How would I do that in Ubuntu precise?

linux

3 Answers

  1. This is how this tutoriall at jsimmons works on Ubuntu 12.04:

    sudo apt-get install ipset

# enter the countrycode that you dont want to block here (for example de for Germay):
DONTBLOCK=de

# download the zonefiles into /tmp/zones/
cd /tmp
wget http://www.ipdeny.com/ipblocks/data/countries/all-zones.tar.gz
mkdir zones
cd zones
tar -xzvf ../all-zones.tar.gz
# remove the zone you want to keep:
rm /tmp/zones/$DONTBLOCK.zone

FOLDER=/etc/zoneipblock/
mkdir $FOLDER
BLOCKLIST=$FOLDER"non_$DONTBLOCK.zone_blocklist"
cat /tmp/zones/*.zone > $BLOCKLIST

#if you want to block only the biggest blocks, use the short list:
BLOCKLIST_SHORT="$BLOCKLIST"_short
cat $BLOCKLIST |grep /8>$BLOCKLIST_SHORT
cat $BLOCKLIST |grep /9>>$BLOCKLIST_SHORT
cat $BLOCKLIST |grep /10>>$BLOCKLIST_SHORT
cat $BLOCKLIST |grep /11>>$BLOCKLIST_SHORT
cat $BLOCKLIST |grep /12>>$BLOCKLIST_SHORT

IPS=$(cat $BLOCKLIST_SHORT)

exit

#TODO: create the list with the right command
#ipset create feckof ...
ipset --create feckoff bitmap:ip range [fromip-toip|ip/cidr]

for i in $IPS; do
ipset add feckof $i
done

iptables -A INPUT -m set –set feckoff src -j DROP

    Thats the script, nearly finished, only the create statement for the feckof list is missing.

    can someone add this in a comment please?

    • 2
  2. Best Answer

    I think you do something wrong. That article is not up to date because it's about 10.04 LTS. Now you can just issue 

    sudo apt-get install ipset

    I've just installed ipset on my 12.04 without any problem. Take a look at my install log https://gist.github.com/3720382

    • 1

  3. Worst case scenario just download the source from Ipset and compile it manually.

    wget http://ipset.netfilter.org/ipset-6.13.tar.bz2
tar xvfj ipset-6.13.tar.bz2
cd ipset-6.13
./configure
make
make check
make install

    For more info check the README or INSTALL or run ./configure --help for some exotic options.

    • 0