ipset - combine individual IP and network subset [SOLVED]

gromovnik · June 2019

Hi to all,
I am trying to figure out how to create a ipset set that will combine an individual IP & a network subnet.

From man pages it should be:
create blacklist4 hash:ip family inet hashsize 4096 maxelem 65536

add blacklist4 xxx.xxx.x.xxx
add blacklist4 xx.xxx.xxx.0/24

?

thanks,
g

akb · June 2019

@gromovnik use hash:net instead of hash:ip:

ipset create blacklist4 hash:net hashsize 4096 maxelem 65536
ipset add blacklist4 xxx.xxx.x.xxx
ipset add blacklist4 xx.xxx.xxx.0/24

Clouvider · June 2019

Remember, each IP is also a network, an IPv4 single host is a /32, an IPv6 single host is a /128.

gromovnik · June 2019

cheers,
g

SplitIce · June 2019

Also keep in mind that if you are doing small networks hash:ip may be quicker as hash net on ipv4 requires the looking up 32 hashes, 128 for ipv6.

Comments