Re: IPset ports question.

[Rob Carlson <rcarlson@kitchenandassociates.com>]

That did it.

Thanks again, Joszef

Jozsef Kadlecsik wrote:
> Hi Rob,
> 
> On Tue, 19 Jul 2005, Rob Carlson wrote:
> 
> 
>>iptables -A testset -m set --set testset src -j
>>LTREJECT
>>iptables -I FORWARD 2 -i eth1 -j testset
>>iptables -I INPUT 2 -i eth1 -j testset
>>
>>This works fine for blocking all traffic.  However
>>since I now want specifically to only drop port 22
>>and port 25 entries (that is most of the nuisance
>>traffic) and allow port 80 for example,  I did the
>>following:
>>
>>ipset -N ports portmap --from 1 --to 1024
>>ipset -A ports 22
>>ipset -A ports 25
>>ipset -B testset :default: -b ports
> 
> 
> You missed to replace the iptables command above with the one
> which instruct the SET target to follow bindings. What you need is
> 
> iptables -A testset -m set --set testset src,dst -j LTREJECT
> 
> Best regards,
> Jozsef
> -
> E-mail  : kadlec@blackhole.kfki.hu, kadlec@sunserv.kfki.hu
> PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
> Address : KFKI Research Institute for Particle and Nuclear Physics
>           H-1525 Budapest 114, POB. 49, Hungary
> 
> 

-- 
Rob Carlson, Systems and Network Administrator
Kitchen & Associates Architectural Services, PA
Architecture - Planning - Interior Design
856.854.1880