Re: ipset not completely working in mangle:PREROUTING

["Kerin Millar" <kfm@plushkava.net>]

On Tue, 26 May 2026, at 1:57 AM, imnozi@gmail.com wrote:
> iptables v1.8.7 (legacy)
> ipset v6.34, protocol version: 6
>
> I have four sets:
>   - blockSetHost (hash:ip)
>   - blockSetNet (hash:net)
>   - whiteSetHost (hash:ip)
>   - whiteSetNet (hash:net)
>
> I added rules to match the block sets in filter to INPUT, FORWARD and 
> OUTPUT. The rules match and jump to chain blDrop. In blDrop, if either 
> white set matches, control returns. If no match, the packet is dropped.
>
> This works well in filter. But there's one artifact. The blocked 
> packets are 'accounted' to the internal server where they would have 
> gone.

The meaning of this isn't altogether clear. I presume that you are referring to counters in some capacity.

>
> To fix this, I added the rules below to mangle. Here in mangle, the 
> white sets never match and all of the packets (that matched the block 
> sets) are dropped.

Be sure that you need to match on the NEW state. Otherwise, -t raw -A PREROUTING makes for a less expensive way of dropping ingress packets at the border.

>
> Is this another instance of 'it doesn't work in mangle or in PREROUTING'?

This is unlikely. Both -m set and -m state work in the same way across tables, though the raw table precludes matching on conntrack state.

>
> Thanks,
> Neal
>
> ----
> The rules used in mangle; eth3 is internet:
> -A blDrop -m set --match-set whiteSetNet src -j RETURN
> -A blDrop -m set --match-set whiteSetHost src -j RETURN
> -A blDrop -j DROP
>
> -A PREROUTING -i eth3 -p udp -m set --match-set blockSetHost src -m 
> state --state NEW -j blDrop
> -A PREROUTING -i eth3 -p tcp -m set --match-set blockSetHost src -m 
> state --state NEW -j blDrop
> -A PREROUTING -i eth3 -p udp -m set --match-set blockSetNet src -m 
> state --state NEW -j blDrop
> -A PREROUTING -i eth3 -p tcp -m set --match-set blockSetNet src -m 
> state --state NEW -j blDrop

An iptables-save -c dump would be preferable. These excerpts don't unambiguously qualify the containing table names. In particular, there is no way for the reader to determine whether the chain named "blDrop" in whatever table that may be is acting in the same way as the chain named "blDrop" that may still exist - or have once existed - in another table.

-- 
Kerin Millar