path: root/extensions/
diff options
authorJozsef Kadlecsik <>2010-06-16 12:45:33 +0200
committerJozsef Kadlecsik <>2010-06-16 12:45:33 +0200
commitd40f1628c3717daebc437a398a285e371b5b6f7f (patch)
tree2b6a94d9198c9214785e0eef7a1c866e3a3e25c6 /extensions/
parent4a498502c10e690798aa78eb92e3aed7ce79f4e0 (diff)
libxt_set: new revision added
libipt_set renamed to libxt_set and the support for the forthcoming ipset release added. I have tested backward (IPv4) and forward compatibility (IPv4/IPv6): ipset -N test iphash ipset -A test test-address iptables -N test-set iptables -A test-set -j LOG --log-prefix "match " iptables -A test-set -j DROP iptables -A OUTPUT -m set --match-set test dst -j test-set ping test-address
Diffstat (limited to 'extensions/')
1 files changed, 23 insertions, 0 deletions
diff --git a/extensions/ b/extensions/
new file mode 100644
index 00000000..aca1bfce
--- /dev/null
+++ b/extensions/
@@ -0,0 +1,23 @@
+This module matches IP sets which can be defined by ipset(8).
+[\fB!\fP] \fB\-\-match\-set\fP \fIsetname\fP \fIflag\fP[\fB,\fP\fIflag\fP]...
+where flags are the comma separated list of
+.BR "src"
+.BR "dst"
+specifications and there can be no more than six of them. Hence the command
+ iptables \-A FORWARD \-m set \-\-match\-set test src,dst
+will match packets, for which (if the set type is ipportmap) the source
+address and destination port pair can be found in the specified set. If
+the set type of the specified set is single dimension (for example ipmap),
+then the command will match packets for which the source address can be
+found in the specified set.
+The option \fB\-\-match\-set\fR can be replaced by \fB\-\-set\fR if that does
+not clash with an option of other extensions.
+Use of -m set requires that ipset kernel support is provided. As standard
+kernels do not ship this currently, the ipset or Xtables-addons package needs
+to be installed.