Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was wondering about the semantics of ipset(8).

Is it possible to add a rule matching a set to iptables and then manipulate the set, or can I only create a set and swap it for an older set in order to apply it to an iptables rule matching the name? I.e. can I add/remove to/from an IP set ad hoc, or can I exchange whole sets while the sets are in active use?

The reason I ask is this is as follows. Say I create a set

ipset create PCs hash:ip
ipset add PCs
ipset add PCs

... et cetera. And a rule that allows access to HTTP:

iptables -A INPUT -p tcp --dport 80 -m set --set PCs src -j ACCEPT

What happens when I run:

ipset add PCs

will the iptables rule now take immediate effect for IP as well?

I saw it's possible to use -j SET --add-set ... to manipulate IP sets ad hoc from within iptables rules. This makes me think it should work to manipulate a set at any given point.

However, the ipset project site seems to suggest that swapping a new (adjusted) set for another is the better alternative. Be it via ipset swap or via ipset restore -!.

Can anyone shed light on this?

share|improve this question
up vote 3 down vote accepted

You can add and remove IPs to your already defined sets on the fly. This is one of the ideas behind IPsets: if this wasn't possible, the whole set extension of iptables wouldn't make much sense.

The primary goal of ipset was to enable you to define (also dynamically) classes of matches (e.g. for dynamically blacklisting malicious hosts without the need to magically add one rule for every single host).

excerpt from the ipset homepage

  • store multiple IP addresses or port numbers and match against the collection by iptables at one swoop
  • dynamically update iptables rules against IP addresses or ports without performance penalty
  • express complex IP address and ports based rulesets with one single iptables rule and benefit from the speed of IP sets
share|improve this answer
Thanks. There's one thing I disagree with, though. Actually it would still make perfect sense, even if a set could not be changed. Picking a set of individual IPs instead of a full subnet, adding huge quantities of IPs/networks/host:port entries ... those are not only cumbersome, but iptables has real limits there. Not to mention the speed improvements ipset can give you over individual rules. Do you have a source for the statement from the last paragraph, btw? +1 for now. – 0xC0000022L May 15 '14 at 0:53
Not definite, but that's what I understood the idea of ipset like. ;) The ipset homepage states three use cases, first two being matching against huge lists (as you mentioned), second one being dynamically updating rules (as I mentioned). – Andreas Wiese May 15 '14 at 1:03

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.