Help with ipset (AC68U 380.62_1)

[kingskib]

Hello,

I am trying to run the selective routing for Netflix script and am encountering the following ipset errors.

+ ipset -A NETFLIX 108.175.32.0/20
ipset v4.5: Unknown set
+ ipset -A AMAZONAWS 52.221.221.128/29
ipset v4.5: Unknown set
+ ipset -A AMAZONAWS 177.71.207.16/29
ipset v4.5: Unknown set

The chart on https://github.com/RMerl/asuswrt-merlin/wiki/Using-ipset says my router uses version 6, but the router itself reports v4.5

Firmware : 380.62_1
ipset v4.5, protocol version 4.
Kernel module protocol version 4.​

Any suggestions on how I can resolve this ipset issue?

 

[Adamm]

Hello,

I am trying to run the selective routing for Netflix script and am encountering the following ipset errors.

+ ipset -A NETFLIX 108.175.32.0/20
ipset v4.5: Unknown set
+ ipset -A AMAZONAWS 52.221.221.128/29
ipset v4.5: Unknown set
+ ipset -A AMAZONAWS 177.71.207.16/29
ipset v4.5: Unknown set

The chart on https://github.com/RMerl/asuswrt-merlin/wiki/Using-ipset says my router uses version 6, but the router itself reports v4.5

Firmware : 380.62_1
ipset v4.5, protocol version 4.
Kernel module protocol version 4.​

Any suggestions on how I can resolve this ipset issue?

Update your firmware, that should upgrade your IPSet version to v6 (plus massive amount of security/performance fixes)

 

[Martineau]

I am trying to run the selective routing for Netflix script and am encountering the following ipset errors.
+ ipset -A NETFLIX 108.175.32.0/20
ipset v4.5: Unknown set
The chart on https://github.com/RMerl/asuswrt-merlin/wiki/Using-ipset says my router uses version 6, but the router itself reports v4.5

Any suggestions on how I can resolve this ipset issue?

IPSET v6.xx is only included with firmware v380.63> for ARM routers.
Hopefully you are using the most recent version of @Xentrk's v3.2 script?

Unfortunately the script is hard-coded for IPSET v6.xx commands (although the IPSET v4.5 syntax is described in the comments header) but previous scripts included code to load the appropriate IPSET modules (depending on the version of IPSET installed) and used variable names rather than explicit commands.

Spoiler: Load appropriate IPSET modules

e.g. v6.xx

ipset create NETFLIX hash:net family inet hashsize 1024 maxelem 65536

vs. v4.5

ipset -N NETFLIX nethash

So if using the load module code

# 380.63+ for ARM routers, IPSET v6  is available...Load appropriate IPSET modules
case $(ipset -v | grep -o "v[4,6]") in
  v6) MATCH_SET='--match-set'; LIST='list'; CREATE='create'; SAVE='save'; RESTORE='restore'; FLUSH='flush'; DESTROY='destroy'; ADD='add'; SWAP='swap'; TEST='test'; DELETE="del"
      IPHASH='hash:ip'; NETHASH='hash:net'; PORTBITMAP="bitmap:port range 1-65535"; IPPORT=; SETNOTFOUND='name does not exist'; TIMEOUT='timeout'
      lsmod | grep -q "xt_set" || for module in ip_set ip_set_hash_net ip_set_hash_ip xt_set
      do modprobe $module; done;;
  v4) MATCH_SET='--set'; LIST='--list'; CREATE='--create'; SAVE='--save'; RESTORE='--restore'; FLUSH='--flush'; DESTROY='--destroy'; ADD='--add'; SWAP='--swap'; TEST='--test'; DELETE="--del"
      IPHASH='iphash'; NETHASH='nethash'; PORTBITMAP="portmap --from 1 --to 65535"; IPPORT="ipporthash"; SETNOTFOUND='Unknown set'; TIMEOUT=; RETAIN_SECS=
      lsmod | grep -q "ipt_set" || for module in ip_set ip_set_nethash ip_set_iphash ipt_set
      do modprobe $module; done;;
  *) logger -st "($(basename $0))" $$ "**ERROR** Unknown ipset version: $(ipset -v). Exiting." && (echo -e "\a";exit 99);;
esac

then the following line would then be compatible with both IPSET v4.5 and v6.32
e.g.

ipset $CREATE NETFLIX $NETHASH

Whilst a firmware upgrade is highly recommended for the security patches alone (if not bug fixes/features), you can of course simply issue the following to create the NETFLIX IPSET

ipset -N NETFLIX nethash

to allow the adding of the IP addresses to the NETFLIX v4.5 IPSET.

ipset -A NETFLIX 108.175.32.0/20

etc.

 

[kingskib]

Thank you both for your reply. I updated my firmware to 384.4 and reentered the script. It is now without the ipset errors.

Cheers,