Hi all,
I'm not able to make ipset works with the "hash:net,iface" type.
I test it with 6.12 and 6.21 on a Debian Wheezy (kernel: 3.2,
iptables: 1.4.14-3.1).
The only real custom is that the interfaces are vlans interfaces and
they are renamed (with ifrename).
For example eth0.100 is vlan100
Here is my configuration (I know this rules are ugly, this is only to test):
# ipset list all_users_if
Name: all_users_if
Type: hash:net,iface
Revision: 0
Header: family inet hashsize 4096 maxelem 65536
Size in memory: 33600
References: 2
Members:
172.20.128.0/24,vlan10
172.20.130.0/24,vlan100
# iptables -L FORWARD -vn
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source
destination
0 0 silentaccept all -- vlan10 * 172.20.128.0/24
0.0.0.0/0 state NEW match-set all_users_if dst,dst
0 0 silentaccept all -- vlan10 * 172.20.128.0/24
0.0.0.0/0 state NEW match-set all_users_if dst
7 420 statefull all -- * * 0.0.0.0/0
0.0.0.0/0
7 420 logdrop all -- * * 0.0.0.0/0
0.0.0.0/0 state NEW
Finally here is the log (doing a simple telnet on port 22 from
172.20.128.41 to 172.20.130.200):
drop: IN=vlan10 OUT=vlan100 MAC=blablabla SRC=172.20.128.41
DST=172.20.130.200 LEN=60 TOS=0x10 PREC=0x00 TTL=63 ID=26887 DF
PROTO=TCP SPT=50617 DPT=22 WINDOW=14600 RES=0x00 SYN URGP=0
Please note that this is working with this rules (without ipset):
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source
destination
5 324 silentaccept all -- vlan10 vlan100 172.20.128.0/24
172.20.130.0/24 state NEW
0 0 statefull all -- * * 0.0.0.0/0
0.0.0.0/0
0 0 logdrop all -- * * 0.0.0.0/0
0.0.0.0/0 state NEW
I really don't understand what I'm missing...
Thanks.
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
