path: root/ipset.8
diff options
authorkadlec <kadlec>2004-02-09 18:01:51 +0000
committerkadlec <kadlec>2004-02-09 18:01:51 +0000
commit24328cb1a7f366e03c92d783e492038bd2d9fef5 (patch)
tree227e6be1c64b8c12e9533c65b0c4a98b633fff04 /ipset.8
parent2c3e49def40b41677182fc9243128f11c5e148e9 (diff)
ipset(8) manpage extended with set match/SET target descriptions (JK)
Diffstat (limited to 'ipset.8')
1 files changed, 33 insertions, 0 deletions
diff --git a/ipset.8 b/ipset.8
index e7aea08..721bc43 100644
--- a/ipset.8
+++ b/ipset.8
@@ -270,6 +270,39 @@ different random initvals (default 8).
.BI "--factor " number
The starting hash size is so many times the number of the entries
(default 4).
+The IP set package adds the `set' match and `SET' target to netfilter:
+.SS set
+The match provides the following option:
+.BR "--set " "setname[:flag,...] flag[,flag]"
+where flags are
+.BR "src"
+.BR "dst" .
+Hence the command
+ iptables -A FORWARD -m set --set test:src dst
+will match packets, for which there is a child-set under the set named
+as test at the source address or port (depending on the type of the set)
+of the packet, and the destination address or port of the
+packet (depending of the type of the child set) is set in the child set.
+The target provides the following option:
+.BR "--add-set " "setname[:flag,...] flag[,flag]"
+add the address(es)/port(s) of the packet to the (child)set
+.BR "--del-set " "setname[:flag,...] flag[,flag]"
+delete the address(es)/port(s) of the packet from the (child)set,
+where flags are
+.BR "src"
+.BR "dst" .
+The flags in the second argument can be preceded by an optional `+' sign,
+which will force overwriting already existing elements in the target set
+when adding elements to a hash type set.
Various error messages are printed to standard error. The exit code
is 0 for correct functioning. Errors which appear to be caused by