RE: Fwd: ipset and counters

["tian fang" <tianfang@gmail.com>]

> 
>      I am using ubuntu 12.04 LTS.

I'll check this out: it should work without any extra effort.

> And I got an issue ,I am sorry if I am wrong because I am a quite newbie.
> 
> I am confused of the "--match-set setname src,dst" .  it seems only 
> the one before the comma is functional. Please look at this .
> 
> I added an IP into the ipset sec,and set the iptables FORWARD Chain as 
> "dst, src" ,I guess this means dst OR src, but unfortunately ,my 
> outgoing packages was dropped.
> 
> If I set two separated lines ,it works.

If the dimension of the set is less than the direction parameters of the set
match/SET target, then that's ignored.

With "--match-set setname src,dst" you instruct ipset that if the named set
stores IP address and port number pairs, then get the source and destination
parameters from the packets, say 192.168.1.1 as source address, TCP port 80
as destination, form the element 192.168.1.1,tcp:80 and look it up in the
given set.

You can't store and lookup IP address pairs, if that's what you want.

Best regards,
Jozsef
 
Jozsef,
    Thanks much for your kindness. Seems I have to set two separated rules
for my purpose.
And I have the last question ,what is the maximum number of the ipset bytes
counters ?

RGS
tian