Score:1

How to combine ipset IPv4 and IPv6 configurations

br flag

I'm running Arch Linux and referring to Simple stateful firewall - ArchWiki.

I have two different bash scripts for creating my iptables rules: one for IPv4 and another for IPv6. Each creates one or more ipset hash lists (sets) using the appropriate family: inet or inet6.

That approach is supported by this answer, "You need to have two different sets: one for IPv4 and another for IPv6."

I use the systemd ipset.service and by default it loads the file /etc/ipset.conf. That config file creates my hash lists of banned ip addresses, etc. ipset uses only one config file, unlike iptables with /etc/iptables/iptables.rules and /etc/iptables/ip6tables.rules.

Each of my iptables bash scripts has this command near the end:

ipset save > /etc/ip6set.conf

What is a good way to combine my ipset hash lists into a single config file that will load as expected upon starting the systemd unit? For example, could I run my bash scripts in a specific order and change the second command to ipset save >> /etc/ip6set.conf to append instead of replace?

That doesn't seem like a good approach (i.e., it is subject to breakage). How do most people deal with this?

Nikita Kipriyanov avatar
za flag
Use `nftables`?
MountainX avatar
br flag
@NikitaKipriyanov: yes, that's the way to go. But for the moment, I have to stay with iptables.
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.