diff --git a/docs/ipsets.xml b/docs/ipsets.xml index 2bc6934b2..1f1c821e0 100644 --- a/docs/ipsets.xml +++ b/docs/ipsets.xml @@ -171,8 +171,13 @@ ACCEPT +sshok $FW tcp 22 As mentioned above, ipsets are well suited for large blacklists. You can maintain your blacklist using the 'ipset' utility without ever having to restart or refresh Shorewall. If you use the SAVE_IPSETS=Yes feature - just be sure to "shorewall save" after altering the blacklist ipset(s). - Example: + just be sure to "shorewall save" after altering the blacklist + ipset(s). + + Example (Note -- this example is applicable to ipset versions up to + and including 2.4. In 2.5, the binding feature of ipsets is scheduled for + removal in favor of different set types that include both IP addresses and + port numbers. Check your ipset documentation): /etc/shorewall/blacklist: @@ -228,4 +233,4 @@ dyn eth3:+Dyn you're all set. You can add and delete addresses from Dyn without having to touch Shorewall. - \ No newline at end of file +