Re: ipset not completely working in mangle:PREROUTING

[<imnozi@gmail.com>]

OUT! OUT, demons of stupidity! Or to use a slightly more modern saw, artificial intelligence is no match for natural stupidity.

It works much better when I also add the VPS IP to the *whitelist*!

Sorry about the noise. Sigh.

Thanks,
Neal


On Mon, 25 May 2026 20:57:36 -0400
<imnozi@gmail.com> wrote:

> iptables v1.8.7 (legacy)
> ipset v6.34, protocol version: 6
> 
> I have four sets:
>   - blockSetHost (hash:ip)
>   - blockSetNet (hash:net)
>   - whiteSetHost (hash:ip)
>   - whiteSetNet (hash:net)
> 
> I added rules to match the block sets in filter to INPUT, FORWARD and OUTPUT. The rules match and jump to chain blDrop. In blDrop, if either white set matches, control returns. If no match, the packet is dropped.
> 
> This works well in filter. But there's one artifact. The blocked packets are 'accounted' to the internal server where they would have gone.
> 
> To fix this, I added the rules below to mangle. Here in mangle, the white sets never match and all of the packets (that matched the block sets) are dropped.
> 
> Is this another instance of 'it doesn't work in mangle or in PREROUTING'?
> 
> Thanks,
> Neal
> 
> ----
> The rules used in mangle; eth3 is internet:
> -A blDrop -m set --match-set whiteSetNet src -j RETURN
> -A blDrop -m set --match-set whiteSetHost src -j RETURN
> -A blDrop -j DROP
> 
> -A PREROUTING -i eth3 -p udp -m set --match-set blockSetHost src -m state --state NEW -j blDrop
> -A PREROUTING -i eth3 -p tcp -m set --match-set blockSetHost src -m state --state NEW -j blDrop
> -A PREROUTING -i eth3 -p udp -m set --match-set blockSetNet src -m state --state NEW -j blDrop
> -A PREROUTING -i eth3 -p tcp -m set --match-set blockSetNet src -m state --state NEW -j blDrop