Fix Bug 5744 unable to use firewall group with recent match condition

* use --match-set instead of --set for ipset match
* re-arrange rules when ipset and recent match are used together. instead of
  appending recent match conditions to the rule; place them before ipset
  match conditions
* add debugging output to look at generated rules

1 files changed, 1 insertions, 1 deletions

diff --git a/lib/Vyatta/IpTables/IpSet.pm b/lib/Vyatta/IpTables/IpSet.pm
index f53202c..a8c455e 100755
--- a/lib/Vyatta/IpTables/IpSet.pm
+++ b/lib/Vyatta/IpTables/IpSet.pm
@@ -439,7 +439,7 @@ sub rule {
     return (undef, "Invalid direction [$direction]") if ! defined $srcdst;
     my $opt = '';
     $opt = '!' if $self->{_negate};
-    return (" -m set $opt --set $grp $srcdst ", );
+    return (" -m set $opt --match-set $grp $srcdst ", );
 }
 
 1;