1

Is there a way to add 0.0.0.0/0 to ipset type hash:net,port? It appears to only support prefix lengths of 1-32 but what if I want an entry in my ipset hash to support all ip traffic on a given port? For example

ipset create testset hash:net,port
ipset add testset 0.0.0.0,22
iptables -I INPUT 1 -m set --match-set testset src, src -j ACCEPT
iptables -I INPUT 2 -j LOG --log-prefix "** FIREWALL **"

will do nothing. SSH traffic will hit the firewall and generate a log. 0.0.0.0/0 isn't accepted as valid CIDR notation, though it seems they added it to hash:net,iface in revision 2. I'm aware I could store the port in a bitmap:port and apply it to it's own iptables rule. However, I specifically would like to store ports in a hash as some ports may care about src ip address and others won't and I don't want to maintain a separate set for 0.0.0.0/0.

  • note that usually the --match-set parameters to use would be src,dst and not src,src. But it depends on the point of view: is it to allow incoming connections to a local ssh (src,dst), or to allow incoming replies from a remote ssh (src,src)? Please check you don't need src,dst instead. – A.B Apr 4 at 12:54
0

The correct syntax would be to use 0.0.0.0/0 as 0.0.0.0 defaults to 0.0.0.0/32. Alas as you discovered this is not supported:

# ipset add testset 0.0.0.0/0,22
ipset v7.3: The value of the CIDR parameter of the IP address is invalid

What you can do instead is to use the same kind of trick used in OpenVPN when overriding routes: split 0.0.0.0/0 in half: 0.0.0.0/1 and 128.0.0.0/1:

ipset add testset 0.0.0.0/1,22
ipset add testset 128.0.0.0/1,22

Note:

Usually, for a server running a local ssh server, the iptables parameters should probably be this:

iptables -I INPUT 1 -m set --match-set testset src,dst -j ACCEPT

Since we're in the INPUT chain, meaning receiving, src,dst means check remote (source) IP and local (destination) port, while src,src would mean check remote (source) IP and remote (source) port. The only usage for this would be to allow reply traffic from remote ssh servers, but this would be usually already handled with -m conntrack --ctstate ESTABLISHED elsewhere instead.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.