This parameter is valid for the create command of all hash type sets. If you know that you have large set of IP Address or Networks you may need use maxelem parameter. Network address with zero prefix size is not accepted either. The port number is interpreted together with a protocol (default TCP) and zero protocol number cannot be used.

The hash:net,port set type uses a hash to store different sized IP network address and port pairs.The hash:ip,port set type uses a hash to store IP address and port number pairs.Network address with zero prefix size cannot be stored in this type of sets. The hash:net set type uses a hash to store different sized IP network addresses.Zero valued MAC addresses cannot be stored in a hash:ip,mac type of set. The hash:ip,mac set type uses a hash to store IP and a MAC address pairs.Zero valued MAC addresses cannot be stored in a hash:mac type of set. The hash:mac set type uses a hash to store MAC addresses.Zero valued IP address cannot be stored in a hash:ip type of set. The hash:ip set type uses a hash to store IP host addresses (default) or network addresses.You can create different type HASH, depend what you need block: Installationĭepend your OS, you need install IPSET and IPTABLES packages. iptables has been the Linux firewall solution since the 2.4 kernel. Perhaps because iptables is the most visible part of the netfilter framework, the framework is commonly referred to collectively as iptables. It is actually a part of the larger netfilter framework. IPTABLES is the user-space tool for configuring firewall rules in the Linux kernel. Unlike normal iptables chains, which are stored and traversed linearly, IP sets are stored in indexed data structures, like addresses, networks, (TCP/UDP) port numbers, MAC addresses, interface names or combinations of them in a way, which making lookups very efficient, even when dealing with large sets. IPSET is an extension to iptables that allows you to create firewall rules that match entire “sets” of addresses at once.

Iptables list