ipset How to add IP range from x to y

Question

I need to add this 81.212.0.0/14 ip range to ipset. But it doesnt calculate lower than /16. I want to add from 81.212.0.0 to 81.215.255.255 IP addresses. Is there any other way but /14.

Im trying to allow connections from a specific IP range.

What I tried:

ipset -A allowiplist 81.212.0.0/14

What I expected:

That should allow connections between 81.212.0.0 - 81.215.255.255 P.S: All other rules works fine except but this.

I think the problem is 81.212.0.0/14 have bigger IP count than 65535, maybe idk.

Answer 1

I think the problem is 81.212.0.0/14 have bigger IP count than 65535, maybe idk.

You may be exactly correct here. If you are using an IPset of type hash, it has a maximal number of elements it can store, settable by the maxelem parameter when creating the IPset... and the default value for maxelem is 65536. And if you use a hash of type bitmap, 65536 addresses is the maximum size of the map.

But what are you using the IPset for? If you are simply matching against the whole /14 segment, a hash-based IPset will be much less efficient than a simple network address & mask-based match.

But if you are just setting up an initial set and planning to later selectively knock out specific IP addresses from it, then it would make sense to use an IPset.

Even so, if the number of knocked-out IPs is expected to be relatively small, it might be sensible to invert the sense of whatever you're doing and use a mask-based match as the general rule and the IPset-based match as exceptions to it.

Something like:

iptables -N maybeAllow81_212
iptables -A maybeAllow81_212 -m set --match-set denyiplist_81_212 src -j DROP
iptables -A maybeAllow81_212 -j ACCEPT

iptables -A INPUT -s 81.212.0.0/14 -j maybeAllow81_212

This way, any traffic that is not coming from within the 81.212.0.0/14 can be processed in the main INPUT chain with essentially just two assembler instructions: one 32-bit AND and one 32-bit comparision. You cannot get much faster than that.

Any traffic from within that segment gets diverted to the maybeAllow81_212 subchain which will do the hash match (with an inverted, hopefully much smaller set to match against with!) and then allow everyone who doesn't match the set to pass.

Answer 2

That can only be because your allowiplist set is of type bitmap:ip (any one of its sub-types), which only allows /16 networks at most, or of type hash:ip (again any one of its sub-types) with the default limit of 65535 elements.

You can see what exact type your set is with:

ipset -t list allowiplist

You rather need to use (any one of) the hash:net ipset types to go lower than /16 networks.

However, the hash:net types do not accept true ranges like e.g. 81.212.5.13-81.212.7.4 like bitmap:ip or hash:ip types do.

You could extend the hash:ip types maxelem limit, but it wouldn't make for an efficient solution.

So if you really need ranges that overlap beyond /16 networks I would advise to use the iptables's own -m iprange match type, if it's possible for your overall setup.