내 IPset 카운터가 증가하지 않는 이유는 무엇입니까?

어디에서든 인바운드 HTTP 및 HTTPS를 허용하고 특정 IP 세트에서 SSH를 허용하며 다른 들어오는 연결을 허용하지 않는 방화벽(Docker 호스트에서 iptables 사용)을 구성하려고 합니다. 나는 원시 iptables보다 구성하기 쉽고 세트의 자동 재구성도 더 쉽게 허용하기 때문에 ipset에 대해 읽은 내용을 좋아합니다. 하지만 왠지 작동하지 않는 것 같습니다. 포트 443이 열려 있어야 하는데 HTTPS를 통해 연결할 수 없습니다. SSH 연결이 작동합니다(비록 잠금을 시도하지는 않았지만). 이 문제를 디버깅하는 동안 ipset의 다양한 컬렉션에 카운터를 추가했습니다. 그러나 iptables의 카운터는 증가하지만 0으로 유지됩니다. 내 연결이 ipset에서 계산되지 않는 이유는 무엇입니까? list:set을 디버그하는 다른/더 나은 방법이 있습니까? 어떻게 해결할 수 있나요?

다음은 방화벽 스크립트입니다(의도: ​​93.241.223.2의 포트 22, 포트 80 및 443의 모든 포트를 허용하고 다른 포트만 허용).

#!/bin/sh

# suffix for set names, to avoid overwriting old sets
timestamp=$(date +%s)

# allow HTTP in general (duplicate sets are due to automated generation of script)
ipset create mds-c-allowhttp4-$timestamp bitmap:port range 0-1024 counters
ipset add mds-c-allowhttp4-$timestamp 80
ipset add mds-c-allowhttp4-$timestamp 443
ipset create mds-c-allowhttp6-$timestamp bitmap:port range 0-1024 counters
ipset add mds-c-allowhttp6-$timestamp 80
ipset add mds-c-allowhttp6-$timestamp 443

# create set with allowed IPv4 ssh connections
ipset create mds-c-allowssh4-$timestamp hash:ip,port family inet counters
ipset add mds-c-allowssh4-$timestamp 93.241.223.2,22
# create set with allowed IPv6 ssh connections
ipset create mds-c-allowssh6-$timestamp hash:ip,port family inet6 counters

# create union of allowed sets
ipset create mds-c-allowcombined-$timestamp list:set counters
ipset add mds-c-allowcombined-$timestamp mds-c-allowhttp4-$timestamp
ipset add mds-c-allowcombined-$timestamp mds-c-allowhttp6-$timestamp
ipset add mds-c-allowcombined-$timestamp mds-c-allowssh4-$timestamp
ipset add mds-c-allowcombined-$timestamp mds-c-allowssh6-$timestamp
# create mds-allowcombined if not already there
ipset create mds-allowcombined list:set counters
# activate new sets
ipset swap mds-c-allowcombined-$timestamp mds-allowcombined

# add iptables rule if not already there
iptables -C DOCKER-USER -i eth0 -m set ! --match-set mds-allowcombined src,dst -j DROP || iptables -I DOCKER-USER -i eth0 -m set ! --match-set mds-allowcombined src,dst -j DROP
ip6tables -C INPUT -i eth0 -m set ! --match-set mds-allowcombined src,dst -j DROP || ip6tables -I INPUT -i eth0 -m set ! --match-set mds-allowcombined src,dst -j DROP

이것은 "ipset --list"의 출력입니다:

Name: mds-c-allowhttp4-1712053688
Type: bitmap:port
Revision: 3
Header: range 0-1024 counters
Size in memory: 16608
References: 1
Number of entries: 2
Members:
80 packets 0 bytes 0
443 packets 0 bytes 0

Name: mds-c-allowhttp6-1712053688
Type: bitmap:port
Revision: 3
Header: range 0-1024 counters
Size in memory: 16608
References: 1
Number of entries: 2
Members:
80 packets 0 bytes 0
443 packets 0 bytes 0

Name: mds-c-allowssh4-1712053688
Type: hash:ip,port
Revision: 6
Header: family inet hashsize 1024 maxelem 65536 counters bucketsize 12 initval 0xac582e33
Size in memory: 280
References: 1
Number of entries: 1
Members:
93.241.223.2,tcp:22 packets 0 bytes 0

Name: mds-c-allowssh6-1712053688
Type: hash:ip,port
Revision: 6
Header: family inet6 hashsize 1024 maxelem 65536 counters bucketsize 12 initval 0x0bd9d478
Size in memory: 216
References: 1
Number of entries: 0
Members:

Name: mds-allowcombined
Type: list:set
Revision: 3
Header: size 8 counters
Size in memory: 336
References: 2
Number of entries: 4
Members:
mds-c-allowhttp4-1712053688 packets 0 bytes 0
mds-c-allowhttp6-1712053688 packets 0 bytes 0
mds-c-allowssh4-1712053688 packets 0 bytes 0
mds-c-allowssh6-1712053688 packets 0 bytes 0

이것은 iptables --list --verbose의 출력입니다:

Chain INPUT (policy ACCEPT 14268 packets, 12M bytes)
 pkts bytes target     prot opt in     out     source               destination
11611   11M f2b-sshd   tcp  --  any    any     anywhere             anywhere             multiport dports ssh

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
 8765  525K DOCKER-USER  all  --  any    any     anywhere             anywhere
 1939  116K DOCKER-ISOLATION-STAGE-1  all  --  any    any     anywhere             anywhere
    0     0 ACCEPT     all  --  any    docker0  anywhere             anywhere             ctstate RELATED,ESTABLISHED
    0     0 DOCKER     all  --  any    docker0  anywhere             anywhere
    0     0 ACCEPT     all  --  docker0 !docker0  anywhere             anywhere
    0     0 ACCEPT     all  --  docker0 docker0  anywhere             anywhere
    0     0 ACCEPT     all  --  any    br-34e695d35afc  anywhere             anywhere             ctstate RELATED,ESTABLISHED
    0     0 DOCKER     all  --  any    br-34e695d35afc  anywhere             anywhere
 1939  116K ACCEPT     all  --  br-34e695d35afc !br-34e695d35afc  anywhere             anywhere
    0     0 ACCEPT     all  --  br-34e695d35afc br-34e695d35afc  anywhere             anywhere

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain DOCKER (2 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     tcp  --  !br-34e695d35afc br-34e695d35afc  anywhere             172.18.0.2           tcp dpt:snpp
    0     0 ACCEPT     tcp  --  !br-34e695d35afc br-34e695d35afc  anywhere             172.18.0.2           tcp dpt:https
    0     0 ACCEPT     tcp  --  !br-34e695d35afc br-34e695d35afc  anywhere             172.18.0.2           tcp dpt:http

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DOCKER-ISOLATION-STAGE-2  all  --  docker0 !docker0  anywhere             anywhere
 1939  116K DOCKER-ISOLATION-STAGE-2  all  --  br-34e695d35afc !br-34e695d35afc  anywhere             anywhere
 1939  116K RETURN     all  --  any    any     anywhere             anywhere

Chain DOCKER-ISOLATION-STAGE-2 (2 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DROP       all  --  any    docker0  anywhere             anywhere
    0     0 DROP       all  --  any    br-34e695d35afc  anywhere             anywhere
 1939  116K RETURN     all  --  any    any     anywhere             anywhere

Chain DOCKER-USER (1 references)
 pkts bytes target     prot opt in     out     source               destination
 6826  409K DROP       all  --  eth0   any     anywhere             anywhere             ! match-set mds-allowcombined src,dst
 1939  116K RETURN     all  --  any    any     anywhere             anywhere

Chain f2b-sshd (1 references)
 pkts bytes target     prot opt in     out     source               destination
11522   11M RETURN     all  --  any    any     anywhere             anywhere