I need to add this ip range to ipset. But it doesnt calculate lower than /16. I want to add from to IP addresses. Is there any other way but /14.

Im trying to allow connections from a specific IP range.

What I tried:

ipset -A allowiplist

What I expected:

That should allow connections between - P.S: All other rules works fine except but this.

I think the problem is have bigger IP count than 65535, maybe idk.

  • Sorry but that makes no sense. Please proof-read, and fix. Then show us what you have tried, and what happened. Apr 7, 2019 at 11:09
  • It may help to edit your question and show examples of what commands you're trying to run, and what the output is. Remember, don't put in screenshots, but cut'n'paste the text itself. Apr 7, 2019 at 11:31
  • Added them now. Thanks. Apr 7, 2019 at 11:49

2 Answers 2


I think the problem is have bigger IP count than 65535, maybe idk.

You may be exactly correct here. If you are using an IPset of type hash, it has a maximal number of elements it can store, settable by the maxelem parameter when creating the IPset... and the default value for maxelem is 65536. And if you use a hash of type bitmap, 65536 addresses is the maximum size of the map.

But what are you using the IPset for? If you are simply matching against the whole /14 segment, a hash-based IPset will be much less efficient than a simple network address & mask-based match.

But if you are just setting up an initial set and planning to later selectively knock out specific IP addresses from it, then it would make sense to use an IPset.

Even so, if the number of knocked-out IPs is expected to be relatively small, it might be sensible to invert the sense of whatever you're doing and use a mask-based match as the general rule and the IPset-based match as exceptions to it.

Something like:

iptables -N maybeAllow81_212
iptables -A maybeAllow81_212 -m set --match-set denyiplist_81_212 src -j DROP
iptables -A maybeAllow81_212 -j ACCEPT

iptables -A INPUT -s -j maybeAllow81_212

This way, any traffic that is not coming from within the can be processed in the main INPUT chain with essentially just two assembler instructions: one 32-bit AND and one 32-bit comparision. You cannot get much faster than that.

Any traffic from within that segment gets diverted to the maybeAllow81_212 subchain which will do the hash match (with an inverted, hopefully much smaller set to match against with!) and then allow everyone who doesn't match the set to pass.

  • Maybe I haven't understood you well but in a hash:net type ipset a network is only one element, not the whole 262k addresses (like it would be in a bitmap:ip type), therefore the maxelem's (configurable) limit of 65535 does not apply to OP's case.
    – LL3
    Apr 7, 2019 at 12:33
  • Whoops, sorry, never mind. I only just noticed that you were referring to hash types in general, not specifically the hash:net one
    – LL3
    Apr 7, 2019 at 14:32

That can only be because your allowiplist set is of type bitmap:ip (any one of its sub-types), which only allows /16 networks at most, or of type hash:ip (again any one of its sub-types) with the default limit of 65535 elements.

You can see what exact type your set is with:

ipset -t list allowiplist

You rather need to use (any one of) the hash:net ipset types to go lower than /16 networks.

However, the hash:net types do not accept true ranges like e.g. like bitmap:ip or hash:ip types do.

You could extend the hash:ip types maxelem limit, but it wouldn't make for an efficient solution.

So if you really need ranges that overlap beyond /16 networks I would advise to use the iptables's own -m iprange match type, if it's possible for your overall setup.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.