Visit Jeremy's Blog.
Go Back > Forums > Linux Forums > Linux - Networking
User Name
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.


  Search this Thread
Old 11-05-2016, 09:30 AM   #1
Registered: Jun 2010
Distribution: Debian, Ubuntu, Win
Posts: 143

Rep: Reputation: 16
ipset not matching in mangle table

Hi All,

I have an ipset group which is configured with a hash:ip,port.

user@svr1:~# ipset list TestSet
Name: TestSet
Type: hash:ip,port
Header: family inet hashsize 1024 maxelem 65536
Size in memory: 16656
References: 7

When I add a record to the POSTROUTING table like this:

iptables -t mangle -I POSTROUTING 1 -m set --match-set TestSet src -j CLASSIFY --set-class 1:99

No packets are ever matched, yet, if I add this record:

iptables -t mangle -I POSTROUTING 1 -p udp -s --sport 12345 -j CLASSIFY --set-class 1:99

It does successfully match the packets.

I can't find any reason why this wouldn't be matching packets as I have sets working fine in other sections.

Has anyone else ever encountered this or am I just overlooking something?

Old 11-05-2016, 09:59 AM   #2
Registered: Jun 2010
Distribution: Debian, Ubuntu, Win
Posts: 143

Original Poster
Rep: Reputation: 16
After a lot more searching, I came across the solution from this source -

In the rules above you specified a single direction flag for a two
dimensional set, thus the matching returned "false". If in the first rule
the port is the destination, then it should be:

Which means my rule should have been listed as:

iptables -t mangle -I POSTROUTING 1 -m set --match-set TestSet src,src -j CLASSIFY --set-class 1:99

Once correcting the missing ",src" the rule's working perfectly.

Hope this is able to help some others in the future.



Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] iptables, iproute2: rerouting not triggered after setting MARK in mangle OUTPUT table fabioca Linux - Networking 1 11-10-2015 01:31 AM
Linux Firewall - (rpm package lacks the NAT/MANGLE table.) andalogokct CentOS 10 08-12-2015 06:00 PM
CentOS Firewall (rpm package lacks NAT/MANGLE table.) andalogokct Linux - Software 1 08-11-2015 07:36 PM
Meanings of IPTABLES mangle table mosharaf_linux Linux - Server 1 02-14-2011 07:53 AM
Mangle Table santhosh23 Linux - General 2 06-24-2007 09:52 PM > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 04:55 AM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration