Show Table of Contents
184.108.40.206.2. ipset Commands
The format of the ipset command is as follows:
ipset [options] command [command-options]Where command is one of:
create | add | del | test | destroy | list | save | restore | flush | rename | swap | help | version | -Allowed options are:
-exist | -output [ plain | save | xml ] | -quiet | -resolve | -sorted | -name | -terse
createcommand is used to create a new data structure to store a set of IP data. The
addcommand adds new data to the set, the data added is referred to as an element of the set.
-existoption suppresses error message if the element already exists, and it has a special role in updating a time out value. To change a time out, use the
ipset addcommand and specify all the data for the element again, changing only the time out value as required, and using the
testoption is for testing if the element already exists within a set.
The format of the
createcommand is as follows:
ipset create set-name type-name [create-options]The set-name is a suitable name chosen by the user, the type-name is the name of the data structure used to store the data comprising the set. The format of the type-name is as follows:
method:datatype[,datatype[,datatype]]The allowed methods for storing data are:
bitmap | hash | listThe allowed data types are:
ip | net | mac | port | ifaceWhen adding, deleting, or testing entries in a set, the same comma separated data syntax must be used for the data that makes up one entry, or element, in the set. For example:
ipset add set-name ipaddr,portnum,ipaddr
A set cannot contain
IPv6addresses at the same time. When a set is created it is bound to a family,
IPv6, and the default is
Example 2.3. Create an IP Set
To create an IP set consisting of a source IP address, a port, and destination IP address, issue a command as follows:
~]#Once the set is created, entries can be added as follows:
ipset create my-set hash:ip,port,ip
ipset add my-set 192.168.1.2,80,192.168.2.2~]#
ipset add my-set 192.168.1.2,443,192.168.2.2
The set types have the following optional parameters in common. They must be specified when the set is created in order for them to be used:
timeout— The value given with the
createcommand will be the default value for the set created. If a value is given with the
addcommand, it will be the initial non-default value for the element.
Example 2.4. List an IP Set
To list the contents of a specific IP Set,
my-set, issue a command as follows:
ipset list my-setName: my-set Type: hash:ip,port,ip Header: family inet hashsize 1024 maxelem 65536 Size in memory: 8360 References: 0 Members: 192.168.1.2,tcp:80,192.168.2.2 192.168.1.2,tcp:443,192.168.2.2
Omit the set name to list all sets.
Example 2.5. Test the Elements of an IP Set
Listing the contents of large sets is time consuming. You can test for the existence of an element as follows:
ipset test my-set 192.168.1.2,80,192.168.2.219220.127.116.11,tcp:80,192.168.2.2 is in set my-set.