The thing is, I currently have 3 virtual test machines, Client1, ip
192.168.1.10, Client2, ip
192.168.2.20 and Router with ip
192.168.2.1 as gateway to connect Client1 and Client2.
On Router, I have
hash:ip,port set, for example:
ipset add myset 192.168.2.20,tcp:80
ipset add myset 192.168.2.20,tcp:443
On Client2 I have nginx setup to listen on port 80, and I don't want Client1 to be able to connect to Client2 via tcp on port 80, on Router I add a rule:
iptables -A FORWARD -m set --match-set myset dst -j DROP
On Client1 I exec
wget 192.168.2.20/index.html and due to my iptables rules on Router, Client1 shouldn't be able to connect to Client2 and grab
index.html, however, it doesn't work and file can be successfully retrieved.
The problem is only with
hash:ip,port set type of ipset. If I choose
hash:ip type and move protocol/port part to iptables out of ipset, everything works fine. However, I need to use exactly ipset to be able to swap block lists any time.
What am I doing wrong? All 3 VMs are running on Ubuntu 17.04, minimal installation, no GUI.