Ipset counters question

* Ipset counters question
@ 2011-03-29 10:31 Jean-Philippe Menil
  2011-03-30 20:17 ` Jozsef Kadlecsik
  0 siblings, 1 reply; 11+ messages in thread
From: Jean-Philippe Menil @ 2011-03-29 10:31 UTC (permalink / raw)
  To: netfilter

Hi,

basiclly, i'm working on a captive portal, who add some rules in 
PRE/POSTROUTING mangle table when a user is fully authenticated.
$IPTABLES -t mangle -N OUT-AUTH
$IPTABLES -t mangle -A PREROUTING -j OUT-AUTH
$IPTABLES -t mangle -N IN-AUTH
$IPTABLES -t mangle -A POSTROUTING -j IN-AUTH

and the following rules are append when an user is authenticate:
$IPTABLES -t mangle -A OUT-AUTH -s $IP -m mac --mac-source $IP -j MARK 
--set-mark 10
$IPTABLES -t mangle -A IN-AUTH -d $IP -j ACCEPT

I dicovered ipset, and begin to play with it.
If my understand of is correct, i can add:

ipset -N TEST macipmap --network 192.168.100.0/24
$IPTABLES -t mangle -A IN-AUTH -m set --set TEST src,dst -j ACCEPT
$IPTABLES -t mangle -A OUT-AUTH -m set --set TEST src,dst -j MARK 
--set-mark 10

And when an user authenticate, add the following ipset:
ipset -A TEST 192.168.100.2,xx:xx:xx:xx:xx:xx

However, for some accountig reason, i used to check the iptables 
counters (-nvxL) by ip.
If i replace, my iptables rules by an ipset type, i cannot check 
counters anymore.

If i decide to use ipset, is there a way to check counters by ip, or 
something like that?

Regards.

-- 
Jean-Philippe Menil - Pôle réseau Service IRTS
DSI Université de Nantes
jean-philippe.menil@univ-nantes.fr
Tel : 02.53.48.49.27 - Fax : 02.53.48.49.09

^ permalink raw reply	[flat|nested] 11+ messages in thread