All of lore.kernel.org
 help / color / mirror / Atom feed
From: Michael Ludvig <mludvig@logix.net.nz>
To: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Cc: netfilter@vger.kernel.org
Subject: Re: ipset hash:ip,port not matching
Date: Tue, 25 Jun 2013 21:05:59 +1200	[thread overview]
Message-ID: <51C95D77.9060405@logix.net.nz> (raw)
In-Reply-To: <alpine.DEB.2.00.1306250937500.12575@blackhole.kfki.hu>

On 25/06/13 19:40, Jozsef Kadlecsik wrote:
> On Tue, 25 Jun 2013, Michael Ludvig wrote:
>
>> ~ # iptables -I INPUT -m set --match-set test-ipport dst -j LOG
>> --log-prefix "IPSET(test-ipport,dst): "
>> ~ # iptables -I INPUT -m set --match-set test-ipport src -j LOG
>> --log-prefix "IPSET(test-ipport,src): "
> In the rules above you specified a single direction flag for a two 
> dimensional set, thus the matching returned "false". If in the first rule 
> the port is the destination, then it should be:
>
> iptables -I INPUT -m set --match-set test-ipport dst,dst -j LOG ...

Thanks! I didn't know I'm supposed to specify the direction for each
dimension of the set. That actually makes it quite flexible.

Is it possible to make iptables fail when there are not enough src's and
dst's in the command? To let users know there's something wrong.

Cheers

Michael

  reply	other threads:[~2013-06-25  9:05 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2013-06-25  6:22 ipset hash:ip,port not matching Michael Ludvig
2013-06-25  6:33 ` Michael Ludvig
2013-06-25  7:40 ` Jozsef Kadlecsik
2013-06-25  9:05   ` Michael Ludvig [this message]
2013-06-25  9:30     ` Jozsef Kadlecsik

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=51C95D77.9060405@logix.net.nz \
    --to=mludvig@logix.net.nz \
    --cc=kadlec@blackhole.kfki.hu \
    --cc=netfilter@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.