I was wondering about the semantics of
Is it possible to add a rule matching a set to
iptables and then manipulate the set, or can I only create a set and swap it for an older set in order to apply it to an
iptables rule matching the name? I.e. can I add/remove to/from an IP set ad hoc, or can I exchange whole sets while the sets are in active use?
The reason I ask is this is as follows. Say I create a set
ipset create PCs hash:ip ipset add PCs 220.127.116.11 ipset add PCs 18.104.22.168
... et cetera. And a rule that allows access to HTTP:
iptables -A INPUT -p tcp --dport 80 -m set --set PCs src -j ACCEPT
What happens when I run:
ipset add PCs 22.214.171.124
iptables rule now take immediate effect for IP 126.96.36.199 as well?
I saw it's possible to use
-j SET --add-set ... to manipulate IP sets ad hoc from within
iptables rules. This makes me think it should work to manipulate a set at any given point.
ipset project site seems to suggest that swapping a new (adjusted) set for another is the better alternative. Be it via
ipset swap or via
ipset restore -!.
Can anyone shed light on this?