multiport tolerance changes

[Vincent Regnard <devel@regnard.org>]

Hi all,

I recently upgraded my firewall setup. Mainly upgrading kernel from 
2.6.8 to 2.6.16 and iptables from 1.2.7 to 1.3.5. And I had to modify my 
  firewall rules due to what I think is a syntax tolerance change 
regarding multiport.

With iptables 1.2.7 I had some rules where I could write some multiport 
(port lists or ranges) both for source and destination ports, like this:

/sbin/iptables -A fw2net_eth3 -p tcp -m multiport -s 82.67.103.87 
--sport 1024:65535 -d 0.0.0.0/0 --dports 80,8080,81,8000,1755 -j ACCEPT

iptables was coping well with this and expanded the port matrix into 
appropriate single rules (ipchains was also able to do this well in its 
good time). But  iptables 1.3.5 refuses to have multiport for both 
source and destination ports and objects:

iptables v1.3.5: multiport can only have one option

So I have to re-write my firewall rules.

What is the reason why this practical feature (expanding the port 
matrix) disapeared ? Is it related to the merge of extended multiport 
into multiport (including ranges in lists) ?
Is there any plan to re-introcduce such a functionality in the future 
releases of iptables ?

Thanks for your comments on this.

Vincent