On 10.08.2024 09:26, Marco Moock wrote:
Hello!
I would like to understand when and why I need --permanent when using ipsets.
My goal is the following: fail2ban should ban IPs via the ipset option through firewalld. I want this way because I prefer to have all firewall stuff at one place.
I've now deleted a permanent ipset, and it still resides in the runtime. Although, I can't delete it from the runtime.
m@zbook:~$ sudo firewall-cmd --permanent --new-ipset=test --type=hash:ip --family=inet success m@zbook:~$ sudo firewall-cmd --delete-ipset=test --permanent success m@zbook:~$ sudo firewall-cmd --get-ipsets test m@zbook:~$ sudo firewall-cmd --get-ipsets --permanent
m@zbook:~$
What is the preferred way to handle that?
You create ipset in firewalld with all necessary rules and let fail2ban dynamically add/remove members to/from this ipset.