Is there a way to match an inet and inet6 IP set in a single rule?

Question

Is it possible to have one IPv4 and one IPv6 IP set (ipset(8)) within the same rule?

I have several rules that depend on one set of IPv4 addresses and another set of IPv6 addresses respectively, but are otherwise identical.

I should add that there is a feature in ipset(8) which sounded hopeful, but turns out to offer no solution to the problem at hand:

list:set
    The list:set type uses a simple list in which you can store set names.
    [...]
    Please note: by the ipset command you can add, delete and test the
    setnames in a list:set type of set, and not the presence of a set's
    member (such as an IP address).

When I did it I wrote a bash script to set it up, it has methods that can write ipv4 and ipv6 rules in one call. see https://github.com/richard-delorenzi/firewall-config/blob/master/my-firewall — ctrl-alt-delor, Jun 16 '14 at 14:57
yes, but did not realise that you that ipsets are about performance, so my tip is of no use. I just looked at the ipset manual, and was thinking there is nothing here about whether you can have ipv6 and ipv4 in the same set, then realised that that is not the question. However it could be the way to do it: can you **create a super set** of ipv4 and ipv6 addresses and then add that to the table. — ctrl-alt-delor, Jun 17 '14 at 08:54
@richard: how would I do that? Feel free to answer, it would be a good thing to know this and I'd add even an additional 50 rep for a comprehensive answer that solves the problem until the end of July :) — 0xC0000022L, Jun 17 '14 at 09:05
I am just learning this my self, as your question got me interested. It looks like you can create a set of v4 addresses, and another set of v6 addresses, then a set of sets (type `list:set` ). You can not test for ip address using `ipset test`, but iptables can. However there in iptables and ip6tables, so I don't know if you can mix them. There would probably not be a performance hit by having to create 2 sets for the 2 chains. I am going back to the idea of copying the rule to both v4 and v6 chain (using a script to ease maintenance, and enforce consistency) — ctrl-alt-delor, Jun 17 '14 at 10:03
@richard: So you are telling me that the `list:set` is the solution after all? Awesome. If you tested this it means the documentation should be updated. Because the statement as given above doesn't distinguish whether the test is done in a netfilter rule or using `ipset`. — 0xC0000022L, Jun 17 '14 at 10:17
Let us [continue this discussion in chat](http://chat.stackexchange.com/rooms/15149/discussion-between-richard-and-0xc0000022l). — ctrl-alt-delor, Jun 17 '14 at 10:20

score 6 · Accepted Answer · edited Apr 13 '17 at 12:36

Turns out richard was right. The list:set type is indeed the solution although I find the wording in the documentation somewhat confusing, if not misleading.

It is possible to have, say the following contents to be used with ipset restore:

create dns4 hash:ip family inet
create dns6 hash:ip family inet6
create dns  list:set
add dns dns4
add dns dns6

you can then use ipset add to add IPs to the member sets (i.e. dns4 and dns6 respectively), but not to the super set (dns) of type list:set.

However the SET (-j SET --add-set dns src --exist) target can actually be told to add the IP to dns and will then only add to the set for which it's possible, which in our case depends on the family option. This will be harder with more sets that could be eligible for adding and IP (or network or ...) in which case the first one will be used to add the entry.

This means that list:set can be used to halve the number of rules where otherwise you'd have to match an IP set per IPv4 and IPv6 rule respectively with an otherwise identical rule.

Is there a way to match an inet and inet6 IP set in a single rule?

1 Answers1