The thing is, I currently have 3 virtual test machines, Client1, ip, Client2, ip and Router with ip and as gateway to connect Client1 and Client2.

On Router, I have hash:ip,port set, for example:
ipset add myset,tcp:80
ipset add myset,tcp:443

On Client2 I have nginx setup to listen on port 80, and I don't want Client1 to be able to connect to Client2 via tcp on port 80, on Router I add a rule: iptables -A FORWARD -m set --match-set myset dst -j DROP

On Client1 I exec wget and due to my iptables rules on Router, Client1 shouldn't be able to connect to Client2 and grab index.html, however, it doesn't work and file can be successfully retrieved.

The problem is only with hash:ip,port set type of ipset. If I choose hash:ip type and move protocol/port part to iptables out of ipset, everything works fine. However, I need to use exactly ipset to be able to swap block lists any time.

What am I doing wrong? All 3 VMs are running on Ubuntu 17.04, minimal installation, no GUI.


Thanks to this comment, the problem is solved:
Instead of
iptables -A FORWARD -m set --match-set myset dst -j DROP
I had to use
iptables -A FORWARD -m set --match-set myset dst,dst -j DROP (two dst instead of one)

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.