2

Using ipset to clean up bulky iptable rulesets does not seem so different between IPv4 and IPv6:

# ipset create TEST hash:net family inet
# ipset create DEMO hash:net family inet6
# iptables -A INPUT -m set --match-set TEST src -j DROP
# ip6tables -A INPUT -m set --match-set DEMO src -j DROP

However, upon adding ip ranges, unexpected errors occur only for IPv6 ranges:

# ipset add TEST 192.0.2.0-192.0.2.127
# ipset add DEMO 2001:db8::-2001:db8::ffff
ipset v6.34: Syntax error: IP address or IP/cidr must be specified: 2001:db8::-2001:db8::ffff

This is unexpected, as ipset appears to be able to parse these IPv6 addresses:

# ipset add DEMO 2001:db8::/112
# ipset del DEMO 2001:db8::/112
# ipset add DEMO 2001:db8::ffff/112
# ipset -L DEMO | tail -2
Members:
2001:db8::/112

Why would ipset accept fromaddr-toaddr ranges for IPv4 but consider the same thing a syntax error for IPv6?

anx
  • 6,875
  • 4
  • 22
  • 45

1 Answers1

2

The fromaddr-toaddr syntax is only supported for IPv4. Use cidr notation to add IPv6 ranges.

For the inet family one can add or delete multiple entries by specifying a range or a network of IPv4 addresses in the IP address part of the entry - man 8 ipset

anx
  • 6,875
  • 4
  • 22
  • 45