From: "U.Mutlu" <um@mutluit.com>
To: Jozsef Kadlecsik <kadlec@netfilter.org>
Cc: netfilter@vger.kernel.org
Subject: Re: [iptables/ipset] Bug? -m set --match-set myset src --packets-gt 2 -j ...
Date: Tue, 17 Oct 2023 02:43:50 +0200 [thread overview]
Message-ID: <652DD8C6.1000207@mutluit.com> (raw)
In-Reply-To: <652DC7AF.1090406@mutluit.com>
Problem solved!
The following command has to come at bottom , not at top:
iptables -A INPUT -m set --match-set blacklist src -j REJECT
U.Mutlu wrote on 10/17/23 01:30:
> Jozsef, thanks. I modified it slightly, but it still doesn't work.
> Can you please inspect why this is not calling the MY_MISC chain?
> The adding via the MY_ADD chain works fine, but the subsequent MY_MISC isn't
> get called.
>
> firewall.sh :
> -------------
> #...
> ipset destroy blacklist
> ipset create blacklist hash:ip hashsize 4096 timeout 300 counters
>
> iptables -N MY_ADD
> iptables -A MY_ADD -j SET --exist --add-set blacklist src
> iptables -A MY_ADD -j RETURN
>
> iptables -N MY_MISC
> #...
> iptables -A MY_MISC -j RETURN
>
> #...
> iptables -A INPUT -m set ! --match-set blacklist src -j MY_ADD
> iptables -A INPUT -m set --match-set blacklist src --packets-gt 2 -j MY_MISC
> #...
>
>
>
> Jozsef Kadlecsik wrote on 10/16/23 21:54:
>> On Mon, 16 Oct 2023, U.Mutlu wrote:
>>
>>> could a kind soul please check why the ipset "match-set" rule below isn't
>>> working.
>>>
>>> It jumps to the chain MY2 only if "--packets-gt 0" or
>>> "--packets-gt 1" is used, but not for any higher values! :-)
>>>
>>> I'm new to ipset, but this very much looks like a bug in iptables or ipset,
>>> IMHO.
>>>
>>>
>>> firewall.sh :
>>> -------------
>>> #...
>>> ipset destroy blacklist
>>> ipset create blacklist hash:ip hashsize 4096 timeout 300 counters
>>> #...
>>> iptables -N MY2
>>> #...
>>> iptables -A MY2 -j RETURN
>>> #...
>>> iptables -A INPUT -j SET --exist --add-set blacklist src
>>> iptables -A INPUT -m set --match-set blacklist src --packets-gt 2 -j MY2
>>
>> Reverse the order of the rules above. With the first one you continuously
>> (re)add the elements to the set with packet number 1.
>
>
prev parent reply other threads:[~2023-10-17 0:43 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-10-16 19:22 [iptables/ipset] Bug? -m set --match-set myset src --packets-gt 2 -j U.Mutlu
2023-10-16 19:54 ` Jozsef Kadlecsik
2023-10-16 23:30 ` U.Mutlu
2023-10-17 0:43 ` U.Mutlu [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=652DD8C6.1000207@mutluit.com \
--to=um@mutluit.com \
--cc=kadlec@netfilter.org \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).