On 10.08.2024 11:12, Marco Moock wrote:
Am 10.08.2024 um 10:22:53 Uhr schrieb Andrei Borzenkov:
On 10.08.2024 09:26, Marco Moock wrote:
Hello!
I would like to understand when and why I need --permanent when using ipsets.
My goal is the following: fail2ban should ban IPs via the ipset option through firewalld. I want this way because I prefer to have all firewall stuff at one place.
I've now deleted a permanent ipset, and it still resides in the runtime. Although, I can't delete it from the runtime.
m@zbook:~$ sudo firewall-cmd --permanent --new-ipset=test --type=hash:ip --family=inet success m@zbook:~$ sudo firewall-cmd --delete-ipset=test --permanent success m@zbook:~$ sudo firewall-cmd --get-ipsets test m@zbook:~$ sudo firewall-cmd --get-ipsets --permanent
m@zbook:~$
What is the preferred way to handle that?
You create ipset in firewalld with all necessary rules and let fail2ban dynamically add/remove members to/from this ipset.
Which of those command will use --permanent and which not?
I do not understand this question, sorry.
In the case above, how can I remove the runtime ipset via firewalld?
You cannot. You also usually do not want to do it, because ipsets are what is used in rules and the goal of ipsets is exactly to avoid having to manage rules dynamically.
Is it normal that ipsets created with firewalld don't show up in "ipset list"?
firewalld defaults to nftables which has its own implementation. If you want to interoperate with ipset, you need to switch backend to iptables.