menu
  + 
    #### 
    Reliable web hosting for your business or personal sites. cPanel + Litespeed included on fast NVMe storage.
    Loaded features and overselling enabled plans to help grow your business. cPanel/WHM + LiteSpeed + NVMe.
    Fine-tuned and optimized for all WordPress sizes. No i/io limits, AccelerateWP + cPanel + LiteSpeed + NVMe.
    KVM VPS servers with NVMe standard. Fast setup. **Free VPS control panel included.**
    Enterprise grade bare-metal servers with **1G / 10G unmetered** options. Fast provisioning.
 / Knowledge Base
# How to block unwanted IP addresses on Linux
## Knowledge Base
25870
June 26, 2024
## Table of Contents
1. 
2. 
3. 
4. 
5. 
6. 
You may want to block IP addresses on your Linux box under various circumstances. For example, as an end user you may want to protect yourself from known spyware or tracker IP addresses. Or when you are running P2P software, you may want to filter out connections from networks associated with anti-P2P activity. If you are a sysadmin, you may want to ban access from spam IP addresses to your production mail server. Or you may wish to block web server access from certain countries for some reason. In many cases, however, your IP address block list can grow quickly to tens of thousands of IP addresses or IP address blocks. How can you deal with it?
## Problems of Netfilter/IPtables
In Linux, banning an IP address can be done very easily with netfilter/iptables framework:
`$ sudo iptables -A INPUT -s 1.1.1.1 -p TCP -j DROP`
If you want to ban a whole IP address block, you can also do it as easily:
`$ sudo iptables -A INPUT -s 1.1.2.0/24 -p TCP -j DROP`
However, what if you have 1,000 independent IP addresses with no common CIDR prefix that you want to ban? You would have 1,000 iptables rules! Clearly this does not scale.
`$ sudo iptables -A INPUT -s 2.2.2.2 -p TCP -j DROP`
`$ sudo iptables -A INPUT -s 3.3.3.3 -p TCP -j DROP`
. . . .
## What are IP Sets?
That is when IP sets come in handy. *IP sets* are a kernel feature which allows multiple (independent) IP addresses, MAC addresses or even port numbers to be encoded and stored efficiently within bitmap/hash kernel data structures. Once an IP set is created, you can create an iptables rule which matches against the set.
You should immediately see the benefit of using IP sets, which is that you can match against multiple IP addresses in an IP set by using a *single* iptables rule! You can construct IP sets using combinations of multiple IP addresses and port numbers, and can dynamically update iptables rules with IP sets without any performance impact.
## Install IPset Tool on Linux
To create and manage IP sets, you need to use a userspace tool called ipset.
To install ipset on Debian, Ubuntu or Linux Mint:
`$ sudo apt-get install ipset`
To install ipset on Fedora or CentOS/RHEL 7:
`$ sudo yum install ipset`
## Ban IP Addresses using IPset Command
Let me walk you through on how to use ipset command using simple examples.
First, let’s create a new IP set named banthis (name can be arbitrary):
`$ sudo ipset create banthis hash:net`
The second argument (hash:net) in the above is required, and represents the type of a set being created. There are multiple types of IP sets. An IP set of hash:net type uses a hash to store multiple CIDR blocks. If you want to store individual IP addresses in a set, you can use hash:ip type instead.
Once you have created an IP set, you can check up on the set with:
`$ sudo ipset list`
!
This shows a list of available IP sets, along with detailed information of each set including set membership. By default, each IP set can contain up to 65536 elements (CIDR blocks in this case). You can increase this limit by appending “maxelem N” option.
`$ sudo ipset create banthis hash:net maxelem 1000000`
Now let’s add IP address blocks to the set:
`$ sudo ipset add banthis 1.1.1.1/32`
`$ sudo ipset add banthis 1.1.2.0/24`
`$ sudo ipset add banthis 1.1.3.0/24`
`$ sudo ipset add banthis 1.1.4.10/24`
You will see that the set membership has been changed.
Now it is time to create an iptables rule using this IP set. The key here is to use “-m set –match-set <name>” option.
Let’s create an iptables rule which prevents all those IP blocks in the set from accessing a web server at port 80. This can be achieved by:
`$ sudo iptables -I INPUT -m set --match-set banthis src -p tcp --destination-port 80 -j DROP`
If you want, you can save a specific IP set to a file, and then later restore it from the file:
`$ sudo ipset save banthis -f banthis.txt`
`$ sudo ipset destroy banthis`
`$ sudo ipset restore -f banthis.txt`
In the above, I tried removing an existing IP set using destroy option to see if I can restore the IP set.
## Automate IP Address Banning
By now you should see how powerful the concept of IP sets is. Still maintaining a up-to-date IP blacklist can be a cumbersome and time-consuming process. In fact, there are free or paid services out there which maintain these IP blacklists for you. As a bonus, let’s see how we can automatically translate available IP blacklists into IP sets.
Let me grab free IP lists from iblocklist.com which publish various IP block lists for free or for a fee. Free versions are available in P2P format.
Here I am going to use an open-source python tool called iblocklist2ipset which converts P2P versions of iblocklist into IP sets.
First, you need to have pip installed.
Then install iblocklist2ipset as follows.
`$ sudo pip install iblocklist2ipset`
On some distros like Fedora, you may need to run:
`$ sudo python-pip install iblocklist2ipset`
Now go to iblocklist.com, and grab any P2P list URL (e.g., “level1” list).
Then paste the URL into the following command.
`$ iblocklist2ipset generate \`
`--ipset banthis "" \`
`> banthis.txt`
After you run the above command, you will get a file named bandthis.txt created. If you check its content, you will see something like:
```
create banthis hash:net family inet hashsize 131072 maxelem 237302
add banthis 1.2.4.0/24
add banthis 1.2.8.0/24
add banthis 1.9.75.8/32
add banthis 1.9.96.105/32
add banthis 1.9.102.251/32
add banthis 1.9.189.65/32
add banthis 1.16.0.0/14
You can simply load this file with ipset command:
Now check the automatically created IP set with:
`$ sudo ipset list banthis`
As of this writing, the “level1” block list contains more than 237,000 IP address blocks. You will see that that many IP address blocks have been added to the IP set.
Finally, go ahead and create a single iptables rule to block them all!
## Summary
In this tutorial, I demonstrated how you can block unwanted IP addresses using a powerful tool called ipset. Combine that with a third-party tool like iblocklist2ipset, and you can easily streamline the process of maintaining your IP block list. For those of you who are curious about the speed improvement of ipset, the figure below shows the benchmark result comparing iptables without and with ipset (credit to daemonkeeper.net).
article credit: 
Tags: 
0
Share Feedback
email
 Submit
previous article
#### 
next article
### Leave a Reply 
You must be  to post a comment.
* cPanel
* Control Panels
* Linux Tips
* Monitoring
* Operating Systems
* Random Stuff
The **LOGICWEB** logo is a registered trademark of LogicWeb Inc. All rights reserved. © 2024
**Company**
**Policies**
**Support**
# How To Add Secondary IP / Alias On Network Interface in RHEL / CentOS 7
15460
December 6, 2024
his guide will show you how to add an extra IP address to an existing interface in Red Hat Enterprise Linux / CentOS 7. There are a few different methods than on CentOS 6, so there may be some confusion if you’re trying this on a CentOS 7 system for the first time.
First, determine if your network interfaces are under the control of the **Network Manager**. If that’s the case, you’ll want to keep using the Network Manager to manage your interfaces and aliases. If it’s not under Network Manager control, you can happily modify your configs by hand.
## View your IP Addresses
The “old” days of Linux used to be all about `ifconfig`. It would show you all interfaces and their IP aliases on the server. In CentOS/RHEL 7, that’s not the case. To see all IP addresses, use the `ip` tool.
$ ip a | grep 'inet '
    inet 127.0.0.1/8 scope host lo
    inet 10.0.2.15/24 brd 10.0.2.255 scope global dynamic eth0
    inet 172.28.128.3/24 brd 172.28.128.255 scope global dynamic eth1
This syntax is more inline with most routers/switches, where you can grep for *inet* and *inet6* for your IPv4 and IPv6 IP addresses.
$ ip a | grep 'inet6 '
    inet6 ::1/128 scope host
    inet6 fe80::a00:27ff:fe19:cd16/64 scope link
    inet6 fe80::a00:27ff:fefd:6f54/64 scope link
So remember: use `ip` over `ifconfig`.
## Using Network Manager
Check if your interface you want to add an alias to, uses the Network Manager.
$ grep 'NM_CONTROLLED' /etc/sysconfig/network-scripts/ifcfg-ens160
NM_CONTROLLED="yes"
If that’s a yes, you can proceed with the next configurations using the Network Manager tool.
You may be used to adding a new *network-scripts* file in `/etc/sysconfig/network-scripts/`, but you’ll find that doesn’t work in RHEL / CentOS 7 as you’d expect if the Network Manager is being used. Here’s what a config would look like in CentOS 6:
$ cat ifcfg-ens160:0
NAME="ens160:0"
ONBOOT="yes"
BOOTPROTO="static"
IPADDR="10.50.10.5"
NETMASK="255.255.255.0"
After a network reload, **the primary IP address will be removed from the server and only the IP address from the alias interface will be present**. That’s not good. That’s the Network Manager misinterpreting your configuration files, overwriting the values from your main interface with the one from your alias.
The simplest/cleanest way to add a new IP address to an existing interface in CentOS 7 is to use the `nmtui` tool (**Text User Interface for controlling NetworkManager**).
$ nmtui
Once `nmtui` is open, go to the *Edit a network connection* and select the interface you want to add an alias on.
Click *Edit* and *tab* your way through to *Add* to add extra IP addresses.
Save the configs and the extra IP will be added.
If you check the text-configs that have been created in `/etc/sysconfig/network-scripts/`, you can see how `nmtui` has added the alias.
$ cat /etc/sysconfig/network-scripts/ifcfg-ens192
...
# Alias on the interface
IPADDR1="10.50.23.11"
PREFIX1="32"
If you want, you can modify the text file, but I find using `nmtui` to be much easier.
## Manually Configuring An Interface Alias
Only use this if your interface is **not** controlled by Network Manager.
NM_CONTROLLED="no"
If Network Manager isn’t used, you can use the old style aliases you’re used to from CentOS 5/6.
DEVICE="ens160:0"
Bring up your alias interace and you’re good to go.
$ ifup ens160:0
Don’t use this if Network Manager is in control.
## Adding a temporary IP address
Want to add an IP address just for a little while? You can add one using the `ip` command. It only lasts until you reboot your server or restart the network service, after that — the IP is gone from the interface.
$ ip a add 10.50.100.5/24 dev eth0
Perfect for temporary IPs!
original source: <
## High Performance VPS Hosting
Check out our NVMe powered KVM VPS plans today for superior performance and network speeds. Multiple global locations available. Free full admin management control panel included.