Bug? -m set --match-set myset src --packets-gt 2 -j ...

iptables/ipset U.Mutlu 2 participants 4 messages Oct 16, 2023 – Oct 17, 2023

lore

Share & tools

lore

U.Mutlu

author

2023-10-16 19:22 UTC #0 lore raw

Hi,
could a kind soul please check why the ipset "match-set" rule below isn't working.

It jumps to the chain MY2 only if "--packets-gt 0" or "--packets-gt 1" is used, but not for any higher values! :-)

I'm new to ipset, but this very much looks like a bug in iptables or ipset, IMHO.

firewall.sh :
-------------
#...
ipset destroy blacklist
ipset create blacklist hash:ip hashsize 4096 timeout 300 counters ipset destroy bl2
ipset create bl2 hash:ip hashsize 4096 timeout 600 counters
#...
iptables -N MY2
#...
iptables -A MY2 -j RETURN
#...
iptables -A INPUT -j SET --exist --add-set blacklist src iptables -A INPUT -m set --match-set blacklist src --packets-gt 2 -j MY2
#...

Thx

OS is stock Debian 11 ("bullseye"):

# iptables --version
iptables v1.8.7 (nf_tables)

# ipset --version
ipset v7.10, protocol version: 7

# uname -a
Linux p21 6.1.0-0.deb11.11-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.38-4~bpo11+1 (2023-08-08) x86_64 GNU/Linux

# cat /etc/os-release
PRETTY_NAME="Debian GNU/Linux 11 (bullseye)"
NAME="Debian GNU/Linux"
VERSION_ID="11"
VERSION="11 (bullseye)"
...

Jozsef Kadlecsik

2023-10-16 19:54 UTC #1 lore raw

Hi,

Quoted 10 lines · U.Mutlu

could a kind soul please check why the ipset "match-set" rule below isn't working.
It jumps to the chain MY2 only if "--packets-gt 0" or "--packets-gt 1" is used, but not for any higher values! :-)
I'm new to ipset, but this very much looks like a bug in iptables or ipset, IMHO.

Quoted 14 lines

firewall.sh :
-------------
#...
ipset destroy blacklist
ipset create blacklist hash:ip hashsize 4096 timeout 300 counters ipset destroy bl2
ipset create bl2 hash:ip hashsize 4096 timeout 600 counters
#...
iptables -N MY2
#...
iptables -A MY2 -j RETURN
#...
iptables -A INPUT -j SET --exist --add-set blacklist src iptables -A INPUT -m set --match-set blacklist src --packets-gt 2 -j MY2

Reverse the order of the rules above. With the first one you continuously (re)add the elements to the set with packet number 1.

Best regards,
Jozsef

Quoted 19 lines

OS is stock Debian 11 ("bullseye"):

# iptables --version
iptables v1.8.7 (nf_tables)

# ipset --version
ipset v7.10, protocol version: 7

# uname -a
Linux p21 6.1.0-0.deb11.11-amd64 #1 SMP PREEMPT_DYNAMIC Debian
6.1.38-4~bpo11+1 (2023-08-08) x86_64 GNU/Linux

# cat /etc/os-release
PRETTY_NAME="Debian GNU/Linux 11 (bullseye)"
NAME="Debian GNU/Linux"
VERSION_ID="11"
VERSION="11 (bullseye)"
...

Signature · 4 lines

E-mail  : [email protected], [email protected]
PGP key : https://wigner.hu/~kadlec/pgp_public_key.txt
Address : Wigner Research Centre for Physics
          H-1525 Budapest 114, POB. 49, Hungary

U.Mutlu

author

2023-10-16 23:31 UTC #2 lore raw

Jozsef, thanks. I modified it slightly, but it still doesn't work.
Can you please inspect why this is not calling the MY_MISC chain?
The adding via the MY_ADD chain works fine, but the subsequent MY_MISC isn't get called.

firewall.sh :
-------------
#...
ipset destroy blacklist
ipset create blacklist hash:ip hashsize 4096 timeout 300 counters

iptables -N MY_ADD
iptables -A MY_ADD -j SET --exist --add-set blacklist src iptables -A MY_ADD -j RETURN

iptables -N MY_MISC
#...
iptables -A MY_MISC -j RETURN

#...
iptables -A INPUT -m set ! --match-set blacklist src -j MY_ADD
iptables -A INPUT -m set --match-set blacklist src --packets-gt 2 -j MY_MISC
#...

Jozsef Kadlecsik wrote on 10/16/23 21:54:

Quoted 27 lines · U.Mutlu

Quoted 11 lines
could a kind soul please check why the ipset "match-set" rule below isn't working.
It jumps to the chain MY2 only if "--packets-gt 0" or "--packets-gt 1" is used, but not for any higher values! :-)
I'm new to ipset, but this very much looks like a bug in iptables or ipset, IMHO.
Quoted 12 lines
firewall.sh :
-------------
#...
ipset destroy blacklist
ipset create blacklist hash:ip hashsize 4096 timeout 300 counters
#...
iptables -N MY2
#...
iptables -A MY2 -j RETURN
#...
iptables -A INPUT -j SET --exist --add-set blacklist src iptables -A INPUT -m set --match-set blacklist src --packets-gt 2 -j MY2
Reverse the order of the rules above. With the first one you continuously (re)add the elements to the set with packet number 1.

U.Mutlu

author

2023-10-17 00:43 UTC #3 lore raw

Problem solved!
The following command has to come at bottom , not at top:
iptables -A INPUT -m set --match-set blacklist src -j REJECT

U.Mutlu wrote on 10/17/23 01:30:

Quoted 56 lines

Jozsef, thanks. I modified it slightly, but it still doesn't work. Can you please inspect why this is not calling the MY_MISC chain? The adding via the MY_ADD chain works fine, but the subsequent MY_MISC isn't get called.
firewall.sh :
-------------
#...
ipset destroy blacklist
ipset create blacklist hash:ip hashsize 4096 timeout 300 counters
iptables -N MY_ADD
iptables -A MY_ADD -j SET --exist --add-set blacklist src iptables -A MY_ADD -j RETURN
iptables -N MY_MISC
#...
iptables -A MY_MISC -j RETURN
#...
iptables -A INPUT -m set ! --match-set blacklist src -j MY_ADD
iptables -A INPUT -m set --match-set blacklist src --packets-gt 2 -j MY_MISC
#...
Jozsef Kadlecsik wrote on 10/16/23 21:54:
Quoted 27 lines · U.Mutlu
Quoted 11 lines
could a kind soul please check why the ipset "match-set" rule below isn't working.
It jumps to the chain MY2 only if "--packets-gt 0" or "--packets-gt 1" is used, but not for any higher values! :-)
I'm new to ipset, but this very much looks like a bug in iptables or ipset, IMHO.
Quoted 12 lines
firewall.sh :
-------------
#...
ipset destroy blacklist
ipset create blacklist hash:ip hashsize 4096 timeout 300 counters
#...
iptables -N MY2
#...
iptables -A MY2 -j RETURN
#...
iptables -A INPUT -j SET --exist --add-set blacklist src iptables -A INPUT -m set --match-set blacklist src --packets-gt 2 -j MY2
Reverse the order of the rules above. With the first one you continuously (re)add the elements to the set with packet number 1.