query regarding hashlimit using ipset src,dst tuple

["Manish Jain" <manish.jain@globallogic.com>]

Hi,

I have a requirement as follows -

Say there are 2 source IPs - src1 and src2, and 2 destination IP - dst1,
dst2.
I need to limit src1->dst1 as well as src2-dst2 communication but want
unlimited src2->dst1 communication.
I have a ipset KNOWN, which contains src1, src2, dst1, dst2

Now i write a rule as follows -
iptables -A INPUT_CHAIN --match hashlimit --hashlimit 1000/s
--hashlimit-mode srcipdstip --hashlimit-name foo -m set --set KNOWN
src,dst -j ACCEPT

But this will limit the src2->dst1 communication as well, which I dont want.

1. Is there a way to add ip1,ip2 as a tuple in a ipset the way we can do for
ip1%port?
2. Is there a mode which can help me do this, using a single iptable rule as
above?
3. Is there a way to specify multiple ipsets in 1 iptable rule?

Thanks & Regards
Manish Jain