Why ipset ?
iptables is enough sufficient but in some cases limit are found:
- High number of rules: iptables is linear
- Need to change the rules often
Independant study available at d(a)emonkeeper’s purgatory has shown that the performance of ipset are almost constant with respect to the number of filtered hosts:
History
The originating project was ippool featuring a a basic set and after some time it has been taken over by Jozsef and renamed ipset. A lot of type of sets are now handled.
ipset 6.x is the current version and features an impressive number of sets.
Architecture
The communication between kernel and userspace is made via netlink
It is not possible to delete a set if it is referenced in kernel by iptables. So it may be appear as a problem but it is possible to use renaming and swapping operation to fix the issue.
The set type are numerous as pointed out here: ipset feature
Using different sets, it is possible to express a global policy in a few iptables rules.
Thanks to Florian Westphal, it is possible to access to set in tc.
Future of ipset
It will soon be possible to have per-element counters and this will allow to do some interesting accounting.