# Ipset-extras, ipset storage and blocking DNS over HTTPS

**URL:** <https://forum.openwrt.org/t/ipset-extras-ipset-storage-and-blocking-dns-over-https/110371>\
**Category:** Talk about Documentation\
**Created:** [October 28, 2021, 5:42pm UTC](https://forum.openwrt.org/t/ipset-extras-ipset-storage-and-blocking-dns-over-https/110371 "2021-10-28T17:42:19Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![marinmo](https://forum.openwrt.org/user_avatar/forum.openwrt.org/marinmo/32/37580_2.png) [@marinmo](https://forum.openwrt.org/u/marinmo)\
**Post date:** [October 28, 2021, 5:42pm UTC](https://forum.openwrt.org/t/ipset-extras-ipset-storage-and-blocking-dns-over-https/110371/1 "2021-10-28T17:42:20Z")

</div>

When following the guide to block DNS over HTTPS from [the wiki](https://openwrt.org/docs/guide-user/firewall/fw3_configurations/intercept_dns#dns_over_https) it assumes [ipset-extras](https://openwrt.org/docs/guide-user/advanced/ipset_extras) and hotplug-extras are installed. The 60-ipset-doh script downloads a list of domains which then is converted into IPs by resolveip used in ipset-extras.

However, ipset-extras sets the resulting ipset to hash:net as seen below, which as far as I understand expects a CIDR-range and not a single IP per entry, see below:

```
uci -q batch << EOI
set firewall.'${IPSET_NAME}'='ipset'
set firewall.'${IPSET_NAME}'.name='${IPSET_NAME}'
set firewall.'${IPSET_NAME}'.family='${IPSET_FAMILY}'
set firewall.'${IPSET_NAME}'.storage='hash'
set firewall.'${IPSET_NAME}'.match='net'
$(sed -n -e "s/^.*${IPSET_MATCH}.*$/\
del_list firewall.'${IPSET_NAME}'.entry='\0'\n\
add_list firewall.'${IPSET_NAME}'.entry='\0'/p" "${IPSET_TEMP}")
EOI
}

```

The resulting ipset is therefore useless for the purpose of blocking. Altering the script to instead store the entries as hash:ip produces the expected results. This can be tested through going through the procedure as described in the wiki-page for blocking DNS over HTTPS and adding a rule as such:

```
config rule
        option name 'testing ipset'
        option src '*'
        option dest '*'
        option proto 'all'
        option family 'ipv4'
        option ipset 'doh dest'
        option target 'REJECT'

```

And trying to ping for example 1.1.1.1 which will succeed. Using hash:ip results in the ping being blocked as expected.

As a solution to this issue, the easiest way would probably be to modify the ipset-extras script to add a {IPSET\_HASH} variable which is set depending on which of the functions (ipset\_domain, ipset\_cidr, ipset\_asn) are called to fill the {IPSET\_ENTRY} variable. Now, my (b)ash scripting skills are seriously subpar, so I'm at a loss of how to properly do this.

Or am I missing something here? 🙂

EDIT: Using OWRT 21.02 and ipset v7.6

---

<div class="post-metadata">

**Author:** ![stangri](https://forum.openwrt.org/user_avatar/forum.openwrt.org/stangri/32/58_2.png) [@stangri](https://forum.openwrt.org/u/stangri)\
**Post date:** [October 28, 2021, 9:39pm UTC](https://forum.openwrt.org/t/ipset-extras-ipset-storage-and-blocking-dns-over-https/110371/2 "2021-10-28T21:39:57Z")

</div>

If I were in your shoes, I'd check who authored latest changes/most of the content of that wiki page and tag that person in your post.

---

<div class="post-metadata">

**Author:** ![vgaetera](https://forum.openwrt.org/user_avatar/forum.openwrt.org/vgaetera/32/113586_2.png) [@vgaetera](https://forum.openwrt.org/u/vgaetera)\
**Post date:** [October 28, 2021, 11:59pm UTC](https://forum.openwrt.org/t/ipset-extras-ipset-storage-and-blocking-dns-over-https/110371/3 "2021-10-28T23:59:26Z")

</div>

> [@marinmo](#):
>
> the resulting ipset to hash:net as seen below, which as far as I understand expects a CIDR-range and not a single IP per entry

It should work with both CIDRs and IPs.

> [@marinmo](#):
>
> am I missing something here?

That's quite possible as it works for me.  
Try to open [https://8.8.8.8/](https://8.8.8.8/) from the client and then check on OpenWrt:

```bash
ipset -t list doh; ipset test doh 8.8.8.8; iptables-save -c | grep -e doh

```