0

Using ipset to clean up bulky iptable rulesets does not seem so different between IPv4 and IPv6:

# ipset create TEST hash:net family inet
# ipset create DEMO hash:net family inet6
# iptables -A INPUT -m set --match-set TEST src -j DROP
# ip6tables -A INPUT -m set --match-set DEMO src -j DROP

However, upon adding ip ranges, unexpected errors occur only for IPv6 ranges:

# ipset add TEST 192.0.2.0-192.0.2.127
# ipset add DEMO 2001:db8::-2001:db8::ffff
ipset v6.34: Syntax error: IP address or IP/cidr must be specified: 2001:db8::-2001:db8::ffff

This is unexpected, as ipset appears to be able to parse these IPv6 addresses:

# ipset add DEMO 2001:db8::/112
# ipset del DEMO 2001:db8::/112
# ipset add DEMO 2001:db8::ffff/112
# ipset -L DEMO | tail -2
Members:
2001:db8::/112

Why would ipset accept fromaddr-toaddr ranges for IPv4 but consider the same thing a syntax error for IPv6?

1

The fromaddr-toaddr syntax is only supported for IPv4. Use cidr notation to add IPv6 ranges.

For the inet family one can add or delete multiple entries by specifying a range or a network of IPv4 addresses in the IP address part of the entry - man 8 ipset

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.