Can iptables rules manipulate IP sets?

Question

In iptables-extensions(8) the set module is described and it is discussed that it is possible to react to the presence or absence of an IP or more generally a match against an IP set.

However, it does not seem that there is a way to append items to an IP set on the fly using an iptables rule.

The idea being that if I use the recent module, I could then temporarily blacklist certain IPs that keep trying and add them into an IP set (which is likely faster). This would mean less rules to traverse for such cases and matching against an IP set is said to be faster as well.

score 6 · Accepted Answer · answered May 27 '14 at 20:30

Turns out it is possible, using the SET target described in iptables-extensions(8).

SET
   This module adds and/or deletes entries from IP sets which can be defined by ipset(8).

   --add-set setname flag[,flag...]
          add the address(es)/port(s) of the packet to the set

   --del-set setname flag[,flag...]
          delete the address(es)/port(s) of the packet from the set

          where flag(s) are src and/or dst specifications and there can be no more
          than six of them.

   --timeout value
          when adding an entry, the timeout value to use instead of the default one
          from the set definition

   --exist
          when  adding  an  entry  if it already exists, reset the timeout value to
          the specified one or to the default from the set definition

   Use of -j SET requires that ipset kernel support is provided, which, for standard
   kernels, is the case since Linux 2.6.39.

I hadn't found it, because I hadn't searched further down after finding the set module description.

Good find. I wasn't aware of it as it is relatively new. 2.6.39 according to that output, the latest RHEL is still using 2.6.32 :-( — phemmer, May 27 '14 at 21:21

score 1 · Answer 2 · answered May 25 '14 at 22:13

1

No, iptables/netfilter cannot manipulate ipset lists.

The set match extension to iptables is a read-only view into ipset lists. The lists are meant to be manipulated with the ipset command only.

The best way to do what you're trying to accomplish is to use the iptables log extension combined with fail2ban.
Iptables would be configured to log each time someone violates your policy, and then once they've violated it X number of times, fail2ban would add that host to the blacklist.

answered May 25 '14 at 22:13

phemmer

70,657
19
188
223

thanks for the answer and the suggestion of an alternative. My first experience with `fail2ban` just now was a bit ... uhm ... stressful. Directly after installation it put the host from which I was connecting to the server (via SSH) onto its blacklist. Luckily I have another server I can use for these cases. But that's not exactly the coolest "default behavior" while being connected via SSH ;) – 0xC0000022L May 25 '14 at 22:47
turns out it is possible. – 0xC0000022L May 27 '14 at 21:02

Can iptables rules manipulate IP sets?

2 Answers2