On Wed, 7 Nov 2012, Eliezer Croitoru wrote: > On 11/7/2012 10:51 PM, Jozsef Kadlecsik wrote: > > No, the idea is to add targets per set entry. I.e. > > > > ipset add foo 192.168.1.1 -t filter -A FORWARD -j LOG --log-prefix foo > > ipset add foo 192.168.1.2 -t filter -A FORWARD -j LOG --log-prefix bar > > > hoo now I understand. > but ipset was meant to be a "set match", no? > In iptables it's a module that match a rule if it matches a set... > it's kind of confusing from iptables idea point of view for me. The SET target then would be extended as a "match and return the result of the target(s) belonging to the element": iptables -A FORWARD -j SET --match-set foo dst Best regards, Jozsef - E-mail : kadlec@xxxxxxxxxxxxxxxxx, kadlecsik.jozsef@xxxxxxxxxxxxx PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt Address : Wigner Research Centre for Physics, Hungarian Academy of Sciences H-1525 Budapest 114, POB. 49, Hungary -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
