Using ipset to clean up bulky iptable rulesets does not seem so different between IPv4 and IPv6:
# ipset create TEST hash:net family inet # ipset create DEMO hash:net family inet6 # iptables -A INPUT -m set --match-set TEST src -j DROP # ip6tables -A INPUT -m set --match-set DEMO src -j DROP
However, upon adding ip ranges, unexpected errors occur only for IPv6 ranges:
# ipset add TEST 192.0.2.0-192.0.2.127 # ipset add DEMO 2001:db8::-2001:db8::ffff ipset v6.34: Syntax error: IP address or IP/cidr must be specified: 2001:db8::-2001:db8::ffff
This is unexpected, as ipset appears to be able to parse these IPv6 addresses:
# ipset add DEMO 2001:db8::/112 # ipset del DEMO 2001:db8::/112 # ipset add DEMO 2001:db8::ffff/112 # ipset -L DEMO | tail -2 Members: 2001:db8::/112
Why would ipset accept
fromaddr-toaddr ranges for IPv4 but consider the same thing a syntax error for IPv6?