Using multiple ipsets in a single rule.
Hi,
After receiving advice that multiple set matching was supported I have written a firewall that uses multiple set matches in a single iptables rule only to receive the error message "--match-set can on be used once". Is there support for matching against more than one set? Or is it possible that this can be done in a future release?
Signature · 1 line
Nikolai Lusan <[email protected]>
Quoted 5 lines · Nikolai Lusan
After receiving advice that multiple set matching was supported I have written a firewall that uses multiple set matches in a single iptables rule only to receive the error message "--match-set can on be used once". Is there support for matching against more than one set? Or is it possible that this can be done in a future release?
Can you give an example?
If i'm right, this is not possible yet but as i'm also patching ipset for my needs i would say that it could be done in a future release.
Signature · 1 line
Andreas Herz
Quoted 5 lines · Nikolai Lusan
After receiving advice that multiple set matching was supported I have written a firewall that uses multiple set matches in a single iptables rule only to receive the error message "--match-set can on be used once". Is there support for matching against more than one set? Or is it possible that this can be done in a future release?
Which is the iptables version you use? The parser has changed several times since the multiple same match support had been added, so the feature might get lost.
Best regards,
Jozsef
-
E-mail : [email protected], [email protected] PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : Wigner Research Centre for Physics, Hungarian Academy of Sciences
H-1525 Budapest 114, POB. 49, Hungary
Quoted 11 lines · Jozsef Kadlecsik
Quoted 5 lines · Nikolai Lusan
After receiving advice that multiple set matching was supported I have written a firewall that uses multiple set matches in a single iptables rule only to receive the error message "--match-set can on be used once". Is there support for matching against more than one set? Or is it possible that this can be done in a future release?
Which is the iptables version you use? The parser has changed several times since the multiple same match support had been added, so the feature might get lost.
No, you must use wrong syntax. Matching against multiple sets is supported via multiple matches, i.e.
iptables ... -m set --match-set foo src,dst -m set --match-set bar src ...
Best regards,
Jozsef
-
E-mail : [email protected], [email protected] PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : Wigner Research Centre for Physics, Hungarian Academy of Sciences
H-1525 Budapest 114, POB. 49, Hungary