1

I need to add this 81.212.0.0/14 ip range to ipset. But it doesnt calculate lower than /16. I want to add from 81.212.0.0 to 81.215.255.255 IP addresses. Is there any other way but /14.

Im trying to allow connections from a specific IP range.

What I tried:

ipset -A allowiplist 81.212.0.0/14

What I expected:

That should allow connections between 81.212.0.0 - 81.215.255.255 P.S: All other rules works fine except but this.

I think the problem is 81.212.0.0/14 have bigger IP count than 65535, maybe idk.

  • Sorry but that makes no sense. Please proof-read, and fix. Then show us what you have tried, and what happened. – ctrl-alt-delor Apr 7 at 11:09
  • It may help to edit your question and show examples of what commands you're trying to run, and what the output is. Remember, don't put in screenshots, but cut'n'paste the text itself. – Stephen Harris Apr 7 at 11:31
  • Added them now. Thanks. – Sezer Toker Apr 7 at 11:49
0

I think the problem is 81.212.0.0/14 have bigger IP count than 65535, maybe idk.

You may be exactly correct here. If you are using an IPset of type hash, it has a maximal number of elements it can store, settable by the maxelem parameter when creating the IPset... and the default value for maxelem is 65536. And if you use a hash of type bitmap, 65536 addresses is the maximum size of the map.

But what are you using the IPset for? If you are simply matching against the whole /14 segment, a hash-based IPset will be much less efficient than a simple network address & mask-based match.

But if you are just setting up an initial set and planning to later selectively knock out specific IP addresses from it, then it would make sense to use an IPset.

Even so, if the number of knocked-out IPs is expected to be relatively small, it might be sensible to invert the sense of whatever you're doing and use a mask-based match as the general rule and the IPset-based match as exceptions to it.

Something like:

iptables -N maybeAllow81_212
iptables -A maybeAllow81_212 -m set --match-set denyiplist_81_212 src -j DROP
iptables -A maybeAllow81_212 -j ACCEPT

iptables -A INPUT -s 81.212.0.0/14 -j maybeAllow81_212

This way, any traffic that is not coming from within the 81.212.0.0/14 can be processed in the main INPUT chain with essentially just two assembler instructions: one 32-bit AND and one 32-bit comparision. You cannot get much faster than that.

Any traffic from within that segment gets diverted to the maybeAllow81_212 subchain which will do the hash match (with an inverted, hopefully much smaller set to match against with!) and then allow everyone who doesn't match the set to pass.

  • Maybe I haven't understood you well but in a hash:net type ipset a 81.212.0.0/14 network is only one element, not the whole 262k addresses (like it would be in a bitmap:ip type), therefore the maxelem's (configurable) limit of 65535 does not apply to OP's case. – LL3 Apr 7 at 12:33
  • Whoops, sorry, never mind. I only just noticed that you were referring to hash types in general, not specifically the hash:net one – LL3 Apr 7 at 14:32
0

That can only be because your allowiplist set is of type bitmap:ip (any one of its sub-types), which only allows /16 networks at most, or of type hash:ip (again any one of its sub-types) with the default limit of 65535 elements.

You can see what exact type your set is with:

ipset -t list allowiplist

You rather need to use (any one of) the hash:net ipset types to go lower than /16 networks.

However, the hash:net types do not accept true ranges like e.g. 81.212.5.13-81.212.7.4 like bitmap:ip or hash:ip types do.

You could extend the hash:ip types maxelem limit, but it wouldn't make for an efficient solution.

So if you really need ranges that overlap beyond /16 networks I would advise to use the iptables's own -m iprange match type, if it's possible for your overall setup.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.