sharingsunshine
asked on
Need IPv6 Ipset Setup
I need to create an ipset for ipv6 I have it for ipv4 already. I want to use ipdeny.com and insert specific country blocks into the ipset which is connected to the iptables.
ASKER
Yes, I know. I need the steps to do it and then load it with the country blocks.
ipset create XXXXX hash:net
ipset add XXXXX 2a01:face:booc:/48
iptables -I INPUT -m ipset --match-set XXXXX src -j DROP
collect the country block and add then with ipset add XXXXX <ip6 range>
ipset add XXXXX 2a01:face:booc:/48
iptables -I INPUT -m ipset --match-set XXXXX src -j DROP
collect the country block and add then with ipset add XXXXX <ip6 range>
ASKER
This looks great but I am getting an error
[root@ip-172-31-22-236 abc.com]# ipset add blockipv6 2a01:face:booc:/48
ipset v6.16.1: Syntax error: '48' is out of range 0-32
booc should be b00k o doesn't translate to a hex digit.
also an IPv6 address should be 128 bits OR have a :: to zero fill until 128 bits.
Actual Facebook IPv6 is:
dig facebook.com aaaa
; <<>> DiG 9.9.4-RedHat-9.9.4-51.el7_ 4.2 <<>> facebook.com aaaa
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10004
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1280
;; QUESTION SECTION:
;facebook.com. IN AAAA
;; ANSWER SECTION:
facebook.com. 261 IN AAAA 2a03:2880:f106:83:face:b00 c:0:25de
;; Query time: 19 msec
iptables command should be ip6tables as well...
also an IPv6 address should be 128 bits OR have a :: to zero fill until 128 bits.
Actual Facebook IPv6 is:
dig facebook.com aaaa
; <<>> DiG 9.9.4-RedHat-9.9.4-51.el7_
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10004
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1280
;; QUESTION SECTION:
;facebook.com. IN AAAA
;; ANSWER SECTION:
facebook.com. 261 IN AAAA 2a03:2880:f106:83:face:b00
;; Query time: 19 msec
iptables command should be ip6tables as well...
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
(ipv4 and ipv6 address cannot be mixed in one list...).
And ipv4 list cannot be used in ip6tbles also iptables cannot use ipset ipv6 address lists.