[prev in list] [next in list] [prev in thread] [next in thread] 

List:       netfilter
Subject:    Re: ipset and hash:net,port,net set
From:       Jozsef Kadlecsik <kadlec () blackhole ! kfki ! hu>
Date:       2013-05-23 20:55:26
Message-ID: alpine.DEB.2.00.1305232253250.4176 () blackhole ! kfki ! hu
[Download RAW message or body]

On Thu, 23 May 2013, Wim Vandersmissen wrote:

> I?m redesigning our firewall to use as much as ipset as possible 
> instead. (great tool) But we have rules that allow a specific source 
> range to some ports for a specific destination range. So the one type of 
> set I?m missing at the moment is hash:net,port,net Of course I could put 
> this in hash:ip,port,net but the hash would get rather big when using 
> /16?s

That'd need a new lookup/storage method: the current hash type is not 
appropriate for such lookups, would be too slow.

Best regards,
Jozsef
-
E-mail  : kadlec@blackhole.kfki.hu, kadlecsik.jozsef@wigner.mta.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : Wigner Research Centre for Physics, Hungarian Academy of Sciences
          H-1525 Budapest 114, POB. 49, Hungary
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
[prev in list] [next in list] [prev in thread] [next in thread]