2.8.9.5.2. ipset Commands

The format of the ipset command is as follows:

ipset [options] command [command-options]

Where command is one of:

create | add | del | test | destroy | list | save | restore | flush | rename | swap | help | version | - 

Allowed options are:

-exist | -output [ plain | save | xml ] | -quiet | -resolve | -sorted | -name | -terse

The create command is used to create a new data structure to store a set of IP data. The add command adds new data to the set, the data added is referred to as an element of the set.

The -exist option suppresses error message if the element already exists, and it has a special role in updating a time out value. To change a time out, use the ipset add command and specify all the data for the element again, changing only the time out value as required, and using the -exist option.

The test option is for testing if the element already exists within a set.

The format of the create command is as follows:

ipset create set-name type-name [create-options]

The set-name is a suitable name chosen by the user, the type-name is the name of the data structure used to store the data comprising the set. The format of the type-name is as follows:

method:datatype[,datatype[,datatype]]

The allowed methods for storing data are:

 bitmap | hash | list 

The allowed data types are:

ip | net | mac | port | iface 

When adding, deleting, or testing entries in a set, the same comma separated data syntax must be used for the data that makes up one entry, or element, in the set. For example:

ipset add set-name ipaddr,portnum,ipaddr

~]# ipset create my-set hash:ip,port,ip

~]# ipset add my-set 192.168.1.2,80,192.168.2.2
~]# ipset add my-set 192.168.1.2,443,192.168.2.2

The set types have the following optional parameters in common. They must be specified when the set is created in order for them to be used:

~]# ipset list my-set
Name: my-set
Type: hash:ip,port,ip
Header: family inet hashsize 1024 maxelem 65536 
Size in memory: 8360
References: 0
Members:
192.168.1.2,tcp:80,192.168.2.2
192.168.1.2,tcp:443,192.168.2.2

~]# ipset test my-set 192.168.1.2,80,192.168.2.2
192.168.1.2,tcp:80,192.168.2.2 is in set my-set.