Link to home
Start Free TrialLog in
Avatar of sharingsunshine
sharingsunshineFlag for United States of America

asked on

Need IPv6 Ipset Setup

I need to create an ipset for ipv6 I have it for ipv4 already.  I want to use ipdeny.com and insert specific country blocks into the ipset which is connected to the iptables.
Avatar of noci
noci

and the question is?  can ipset handle ipv6..., yes it can but it needs a different list from the Ipv4 addresses.
(ipv4 and ipv6 address cannot be mixed in one list...).
And ipv4 list cannot be used in ip6tbles also iptables cannot use ipset ipv6 address lists.
Avatar of sharingsunshine

ASKER

Yes, I know.  I need the steps to do it and then load it with the country blocks.
ipset create XXXXX hash:net
ipset add XXXXX 2a01:face:booc:/48
iptables -I INPUT -m ipset --match-set XXXXX src -j DROP

collect the country block and add then with ipset add XXXXX <ip6 range>
This looks great but I am getting an error

[root@ip-172-31-22-236 abc.com]# ipset add blockipv6 2a01:face:booc:/48
ipset v6.16.1: Syntax error: '48' is out of range 0-32

Open in new window

booc should be b00k   o doesn't translate to a hex digit.
also an IPv6 address should be 128 bits OR have a ::  to zero fill until 128 bits.
Actual Facebook IPv6 is:

 dig facebook.com aaaa

; <<>> DiG 9.9.4-RedHat-9.9.4-51.el7_4.2 <<>> facebook.com aaaa
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10004
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1280
;; QUESTION SECTION:
;facebook.com.                  IN      AAAA

;; ANSWER SECTION:
facebook.com.           261     IN      AAAA    2a03:2880:f106:83:face:b00c:0:25de

;; Query time: 19 msec

iptables command should be ip6tables as well...
SOLUTION
Avatar of arnold
arnold
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
ASKER CERTIFIED SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial