#4951 Iptables and ipset

[aslan]

Not correct work with 2 ipset argument. My rules like
-A PREROUTING -p tcp -m tcp --dport 443 -m set --match-set usr src -m set ! --match-set ignore dst -j REDIRECT --to-ports 3129
Webmin not correct save such rules

[Jamie Cameron]

What does Webmin do to rules like this exactly?

[aslan]

1. Add this rules
2. iptables-save > /etc/iptables.restore
3. Open webmin and go iptables. Show nat tables
4. Open added rule (-A PREROUTING -p tcp -m tcp --dport 443 -m set --match-set usr src -m set ! --match-set ignore dst -j REDIRECT --to-ports 3129) and press save
5. press Apply Configuration
6. Getting Error
   "iptables-restore v1.6.0: --match-set can be specified only once Error occurred at line: 60 Try iptables-restore -h or iptables-restore --help for more information."

If openned /etc/iptables.restore we see rules like
-A PREROUTING -p tcp -m tcp -m set --dport 443 -j REDIRECT --to-ports 3129 --match-set usr src ! --match-set ignore dst

[Jamie Cameron]

That's unusual - so the difference appears to be that -m set needs to be listed before each use of --match-set ?

[aslan]

Yes, I think so.

[Jamie Cameron]

Ok, that's surprising - due to the way the iptables module is written currently, fixing this won't be easy (it assumes that parameter order doesn't matter)

[aslan]

Any news?

[Jamie Cameron]

Fix is still pending, due to the complexity of the code change.

[aslan]

Hi! No news?

[aslan]

The bug was opened 3 years ago. No news?

[Jamie Cameron]

No, in practice we aren't going to be able to fix this any time soon as it would involve a re-write of the whole UI for the iptables module.