firewall: port forward with ipset

Is there an existing issue for this?

• I have searched the existing issues

screenshots or captures

No response

Actual behaviour

Hi!

I have defined an ipset with match type src_ip. I added some entries (source IP-s) to it. I defined a port forward for my local server using the previously defined ipset. I click Save & Apply and all works as expected.
When I add a new IP to the ipset and click Save & Apply, than I can reach the server from the new IP too. But, when I delete some IP-s (even just one) from the ipset and click Save & Apply, the server can be reached from the deleted source IPs until I manually restart the firewall. The main problem with this for me, that I need (automatically by a script) to modify this ipset over JSON RPC.

Expected behaviour

When I modify my ipset entries and click Save & Apply, than from the deleted source IPs should not reach the server.

Steps to reproduce

1. Go to Network->Firewall->IP Sets
2. Click Add
3. Set a Name for it, change the Packet Field Match to src_ip: Source IP, add some IPs to the ipset
4. Save it
5. Go to Network->Firewall->Port Forwards
6. Click Add
7. Set a Name for it, set the External port, set the Internal IP address, the Internal port and on the Advanced settings tab set the previously saved ipset
8. Click Save & Apply
9. Now you can reach on the External port your internal device from the defined IP addresses
10. Go to Network->Firewall->IP Sets
11. Click edit at the previously defined IP set
12. Delete some IP from it, and when you want, you can add a new one to it
13. Click Save & Apply
14. You can still reach the internal device on the external port from the deleted IP address

Additional Information

NAME="OpenWrt"
VERSION="23.05.5"
ID="openwrt"
ID_LIKE="lede openwrt"
PRETTY_NAME="OpenWrt 23.05.5"
VERSION_ID="23.05.5"
HOME_URL="https://openwrt.org/"
BUG_URL="https://bugs.openwrt.org/"
SUPPORT_URL="https://forum.openwrt.org/"
BUILD_ID="r24106-10cc5fcd00"
OPENWRT_BOARD="ramips/mt7621"
OPENWRT_ARCH="mipsel_24kc"
OPENWRT_TAINTS=""
OPENWRT_DEVICE_MANUFACTURER="OpenWrt"
OPENWRT_DEVICE_MANUFACTURER_URL="https://openwrt.org/"
OPENWRT_DEVICE_PRODUCT="Generic"
OPENWRT_DEVICE_REVISION="v0"
OPENWRT_RELEASE="OpenWrt 23.05.5 r24106-10cc5fcd00"


But the same happens on 24.10.0-rc2.

What browsers do you see the problem on?

No response

Relevant log output

No response

Start by reproducing the issue through Network→Firewall→IP Sets and Port Forwards on the affected OpenWrt versions, then trace the LuCI Save & Apply and JSON RPC handling for ipset changes. Done means deleted source IPs can no longer reach the forwarded internal device after applying changes, while newly added IPs continue to work.