From: Michael Ludvig <mludvig@logix.net.nz>
To: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Cc: netfilter@vger.kernel.org
Subject: Re: ipset hash:ip,port not matching
Date: Tue, 25 Jun 2013 21:05:59 +1200 [thread overview]
Message-ID: <51C95D77.9060405@logix.net.nz> (raw)
In-Reply-To: <alpine.DEB.2.00.1306250937500.12575@blackhole.kfki.hu>
On 25/06/13 19:40, Jozsef Kadlecsik wrote:
> On Tue, 25 Jun 2013, Michael Ludvig wrote:
>
>> ~ # iptables -I INPUT -m set --match-set test-ipport dst -j LOG
>> --log-prefix "IPSET(test-ipport,dst): "
>> ~ # iptables -I INPUT -m set --match-set test-ipport src -j LOG
>> --log-prefix "IPSET(test-ipport,src): "
> In the rules above you specified a single direction flag for a two
> dimensional set, thus the matching returned "false". If in the first rule
> the port is the destination, then it should be:
>
> iptables -I INPUT -m set --match-set test-ipport dst,dst -j LOG ...
Thanks! I didn't know I'm supposed to specify the direction for each
dimension of the set. That actually makes it quite flexible.
Is it possible to make iptables fail when there are not enough src's and
dst's in the command? To let users know there's something wrong.
Cheers
Michael
next prev parent reply other threads:[~2013-06-25 9:05 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-06-25 6:22 ipset hash:ip,port not matching Michael Ludvig
2013-06-25 6:33 ` Michael Ludvig
2013-06-25 7:40 ` Jozsef Kadlecsik
2013-06-25 9:05 ` Michael Ludvig [this message]
2013-06-25 9:30 ` Jozsef Kadlecsik
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=51C95D77.9060405@logix.net.nz \
--to=mludvig@logix.net.nz \
--cc=kadlec@blackhole.kfki.hu \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox