[pve-devel] [PATCH] implement ipset ip/net groups

[Dietmar Maurer]

> >>Stupid question, but why do we need different types - netgroups and
> ipgroup?
> >>
> >>We can easily represent a single IP as network: 192.168.0.1/32
> or is there a problem with that?
> t
> I think it's just speed or hash memory optimisation
> 
> I found a good presentation here :
> http://workshop.netfilter.org/2013/wiki/images/a/ab/Jozsef_Kadlecsik_ipse
> t-osd-public.pdf
>
> But I think you can indeed use net:hash for /32

Yes, I would like to have onyl one type for ipsets.
 
But maybe we can support 'nomatch', and comments?

------------------------
[ipset set1]
192.168.0.0/24 # comments would be nice to have
! 192.168.0.1 # nomatch support
1.2.3.4
10.0.0.0/8
-------------------------