[ipset] Match both on source AND destination

[ipset] Match both on source AND destination

[Jimmy Thrasibule]

Hi,

Is it possible to match both source and destination from the same set.

I have two networks:

- 192.168.1.0/24
- 192.168.2.0/24

And I'd like to match packets going from one to another (the set can be
bigger of course).

Without ipset it would be:

-A FORWARD -s 192.168.1.0/24 -d 192.168.2.0/24 -j ACCEPT

However this won't work using ipset:

-A FORWARD -m set --match-set mynets src,dst -j ACCEPT

However, as stated in the man page match is done only on src and
therefore this is not the behavior I was expecting.

A part from listing each networks one by one, do you see any solution
for that?

--
Jimmy

Re: [ipset] Match both on source AND destination

[Jozsef Kadlecsik]

On Thu, 11 Apr 2013, Jimmy Thrasibule wrote:

> Is it possible to match both source and destination from the same set.
> 
> I have two networks:
> 
> - 192.168.1.0/24
> - 192.168.2.0/24
> 
> And I'd like to match packets going from one to another (the set can be
> bigger of course).
> 
> Without ipset it would be:
> 
> -A FORWARD -s 192.168.1.0/24 -d 192.168.2.0/24 -j ACCEPT
> 
> However this won't work using ipset:
> 
> -A FORWARD -m set --match-set mynets src,dst -j ACCEPT

Apply two matches:

-A FORWARD -m set --match-set mynets src -m set --match-set mynets dst ...

Best regards,
Jozsef
-
E-mail  : kadlec@blackhole.kfki.hu, kadlecsik.jozsef@wigner.mta.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : Wigner Research Centre for Physics, Hungarian Academy of Sciences
          H-1525 Budapest 114, POB. 49, Hungary

Re: [ipset] Match both on source AND destination

[Jimmy Thrasibule]

> 
> Apply two matches:
> 
> -A FORWARD -m set --match-set mynets src -m set --match-set mynets dst ...

Ah,

That's the first thing I tried but as I didn't load the module twice it
wouldn't work.

Thanks.

--
Jimmy

Re: [ipset] Match both on source AND destination

[Jozsef Kadlecsik]

On Thu, 11 Apr 2013, Jimmy Thrasibule wrote:

> > Apply two matches:
> > 
> > -A FORWARD -m set --match-set mynets src -m set --match-set mynets dst ...
> 
> Ah,
> 
> That's the first thing I tried but as I didn't load the module twice it
> wouldn't work.

Sorry, I don't understand. Why would you need to load the module twice?
There's no need to load the module at all.

Best regards,
Jozsef
-
E-mail  : kadlec@blackhole.kfki.hu, kadlecsik.jozsef@wigner.mta.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : Wigner Research Centre for Physics, Hungarian Academy of Sciences
          H-1525 Budapest 114, POB. 49, Hungary

Re: [ipset] Match both on source AND destination

[Jimmy Thrasibule]

[-- Attachment #1: Type: text/plain, Size: 745 bytes --]


> On Thu, 11 Apr 2013, Jimmy Thrasibule wrote:
> 
> > > Apply two matches:
> > > 
> > > -A FORWARD -m set --match-set mynets src -m set --match-set mynets dst ...
> > 
> > Ah,
> > 
> > That's the first thing I tried but as I didn't load the module twice it
> > wouldn't work.
> 
> Sorry, I don't understand. Why would you need to load the module twice?
> There's no need to load the module at all.

I just mean that I tried something like:

-m set --match-set mynets src --match-set mynets dst

And I got an error saying that --match-set can only be used once. And by
module I was more talking about the match option -m until now I was
thinking that calling it only once would be enough for the whole rule.

--
Jimmy


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 836 bytes --]

Re: [ipset] Match both on source AND destination

[Jozsef Kadlecsik]

On Thu, 11 Apr 2013, Jimmy Thrasibule wrote:

> > On Thu, 11 Apr 2013, Jimmy Thrasibule wrote:
> > 
> > > > Apply two matches:
> > > > 
> > > > -A FORWARD -m set --match-set mynets src -m set --match-set mynets dst ...
> > > 
> > > Ah,
> > > 
> > > That's the first thing I tried but as I didn't load the module twice it
> > > wouldn't work.
> > 
> > Sorry, I don't understand. Why would you need to load the module twice?
> > There's no need to load the module at all.
> 
> I just mean that I tried something like:
> 
> -m set --match-set mynets src --match-set mynets dst
> 
> And I got an error saying that --match-set can only be used once. And by
> module I was more talking about the match option -m until now I was
> thinking that calling it only once would be enough for the whole rule.

Then your *iptables* version is too old.

Best regards,
Jozsef
-
E-mail  : kadlec@blackhole.kfki.hu, kadlecsik.jozsef@wigner.mta.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : Wigner Research Centre for Physics, Hungarian Academy of Sciences
          H-1525 Budapest 114, POB. 49, Hungary