Hello!
I would like to understand when and why I need --permanent when using ipsets.
My goal is the following: fail2ban should ban IPs via the ipset option through firewalld. I want this way because I prefer to have all firewall stuff at one place.
I've now deleted a permanent ipset, and it still resides in the runtime. Although, I can't delete it from the runtime.
m@zbook:~$ sudo firewall-cmd --permanent --new-ipset=test --type=hash:ip --family=inet success m@zbook:~$ sudo firewall-cmd --delete-ipset=test --permanent success m@zbook:~$ sudo firewall-cmd --get-ipsets test m@zbook:~$ sudo firewall-cmd --get-ipsets --permanent
m@zbook:~$
What is the preferred way to handle that?
On 10.08.2024 09:26, Marco Moock wrote:
Hello!
I would like to understand when and why I need --permanent when using ipsets.
My goal is the following: fail2ban should ban IPs via the ipset option through firewalld. I want this way because I prefer to have all firewall stuff at one place.
I've now deleted a permanent ipset, and it still resides in the runtime. Although, I can't delete it from the runtime.
m@zbook:~$ sudo firewall-cmd --permanent --new-ipset=test --type=hash:ip --family=inet success m@zbook:~$ sudo firewall-cmd --delete-ipset=test --permanent success m@zbook:~$ sudo firewall-cmd --get-ipsets test m@zbook:~$ sudo firewall-cmd --get-ipsets --permanent
m@zbook:~$
What is the preferred way to handle that?
You create ipset in firewalld with all necessary rules and let fail2ban dynamically add/remove members to/from this ipset.
Am 10.08.2024 um 10:22:53 Uhr schrieb Andrei Borzenkov:
On 10.08.2024 09:26, Marco Moock wrote:
Hello!
I would like to understand when and why I need --permanent when using ipsets.
My goal is the following: fail2ban should ban IPs via the ipset option through firewalld. I want this way because I prefer to have all firewall stuff at one place.
I've now deleted a permanent ipset, and it still resides in the runtime. Although, I can't delete it from the runtime.
m@zbook:~$ sudo firewall-cmd --permanent --new-ipset=test --type=hash:ip --family=inet success m@zbook:~$ sudo firewall-cmd --delete-ipset=test --permanent success m@zbook:~$ sudo firewall-cmd --get-ipsets test m@zbook:~$ sudo firewall-cmd --get-ipsets --permanent
m@zbook:~$
What is the preferred way to handle that?
You create ipset in firewalld with all necessary rules and let fail2ban dynamically add/remove members to/from this ipset.
Which of those command will use --permanent and which not? In the case above, how can I remove the runtime ipset via firewalld?
Is it normal that ipsets created with firewalld don't show up in "ipset list"?
On 10.08.2024 11:12, Marco Moock wrote:
Am 10.08.2024 um 10:22:53 Uhr schrieb Andrei Borzenkov:
On 10.08.2024 09:26, Marco Moock wrote:
Hello!
I would like to understand when and why I need --permanent when using ipsets.
My goal is the following: fail2ban should ban IPs via the ipset option through firewalld. I want this way because I prefer to have all firewall stuff at one place.
I've now deleted a permanent ipset, and it still resides in the runtime. Although, I can't delete it from the runtime.
m@zbook:~$ sudo firewall-cmd --permanent --new-ipset=test --type=hash:ip --family=inet success m@zbook:~$ sudo firewall-cmd --delete-ipset=test --permanent success m@zbook:~$ sudo firewall-cmd --get-ipsets test m@zbook:~$ sudo firewall-cmd --get-ipsets --permanent
m@zbook:~$
What is the preferred way to handle that?
You create ipset in firewalld with all necessary rules and let fail2ban dynamically add/remove members to/from this ipset.
Which of those command will use --permanent and which not?
I do not understand this question, sorry.
In the case above, how can I remove the runtime ipset via firewalld?
You cannot. You also usually do not want to do it, because ipsets are what is used in rules and the goal of ipsets is exactly to avoid having to manage rules dynamically.
Is it normal that ipsets created with firewalld don't show up in "ipset list"?
firewalld defaults to nftables which has its own implementation. If you want to interoperate with ipset, you need to switch backend to iptables.
Am Sat, 10 Aug 2024 18:51:42 +0300 schrieb Andrei Borzenkov arvidjaar@gmail.com:
On 10.08.2024 11:12, Marco Moock wrote:
Am 10.08.2024 um 10:22:53 Uhr schrieb Andrei Borzenkov:
On 10.08.2024 09:26, Marco Moock wrote:
Hello!
I would like to understand when and why I need --permanent when using ipsets.
My goal is the following: fail2ban should ban IPs via the ipset option through firewalld. I want this way because I prefer to have all firewall stuff at one place.
I've now deleted a permanent ipset, and it still resides in the runtime. Although, I can't delete it from the runtime.
m@zbook:~$ sudo firewall-cmd --permanent --new-ipset=test --type=hash:ip --family=inet success m@zbook:~$ sudo firewall-cmd --delete-ipset=test --permanent success m@zbook:~$ sudo firewall-cmd --get-ipsets test m@zbook:~$ sudo firewall-cmd --get-ipsets --permanent
m@zbook:~$
What is the preferred way to handle that?
You create ipset in firewalld with all necessary rules and let fail2ban dynamically add/remove members to/from this ipset.
Which of those command will use --permanent and which not?
I do not understand this question, sorry.
When do I use --permanent when using ipsets? I want to know which commands I need to use in fail2ban for actionstart, actionstop, banaction etc.
I need to know when I need to use --permanent and when not.
In the case above, how can I remove the runtime ipset via firewalld?
You cannot. You also usually do not want to do it, because ipsets are what is used in rules and the goal of ipsets is exactly to avoid having to manage rules dynamically.
Ok, so I have to create and delete ipsets in --permanent mode? f2b works like that it creates its environment when being started and completely cleans that up when stopping f2b.
Is it normal that ipsets created with firewalld don't show up in "ipset list"?
firewalld defaults to nftables which has its own implementation. If you want to interoperate with ipset, you need to switch backend to iptables.
Thanks. I didn't know that ipset is iptables. I won't switch back to iptables if I can manage that all via firewalld.
firewalld-users@lists.fedorahosted.org
-
Andrei Borzenkov -
Marco Moock