Does upset hash:net,port support 0.0.0.0/0
2
votes
1
answer
1455
views
Is there a way to add 0.0.0.0/0 to ipset type hash:net,port? It appears to only support prefix lengths of 1-32 but what if I want an entry in my ipset hash to support all ip traffic on a given port? For example
ipset create testset hash:net,port
ipset add testset 0.0.0.0,22
iptables -I INPUT 1 -m set --match-set testset src, src -j ACCEPT
iptables -I INPUT 2 -j LOG --log-prefix "** FIREWALL **"
will do nothing. SSH traffic will hit the firewall and generate a log. 0.0.0.0/0 isn't accepted as valid CIDR notation, though it seems they added it to hash:net,iface in revision 2. I'm aware I could store the port in a bitmap:port and apply it to it's own iptables rule. However, I specifically would like to store ports in a hash as some ports may care about src ip address and others won't and I don't want to maintain a separate set for 0.0.0.0/0.
Asked by AHein
(23 rep)
Apr 3, 2020, 01:19 PM
Last activity: Apr 4, 2020, 01:02 PM
Last activity: Apr 4, 2020, 01:02 PM