mjhjmtu

The thing is, I currently have 3 virtual test machines, Client1, ip 192.168.1.10, Client2, ip 192.168.2.20 and Router with ip 192.168.1.1 and 192.168.2.1 as gateway to connect Client1 and Client2.

On Router, I have hash:ip,port set, for example:
ipset add myset 192.168.2.20,tcp:80
ipset add myset 192.168.2.20,tcp:443

On Client2 I have nginx setup to listen on port 80, and I don't want Client1 to be able to connect to Client2 via tcp on port 80, on Router I add a rule: iptables -A FORWARD -m set --match-set myset dst -j DROP

On Client1 I exec wget 192.168.2.20/index.html and due to my iptables rules on Router, Client1 shouldn't be able to connect to Client2 and grab index.html, however, it doesn't work and file can be successfully retrieved.

The problem is only with hash:ip,port set type of ipset. If I choose hash:ip type and move protocol/port part to iptables out of ipset, everything works fine. However, I need to use exactly ipset to be able to swap block lists any time.

What am I doing wrong? All 3 VMs are running on Ubuntu 17.04, minimal installation, no GUI.

Thanks to this comment, the problem is solved:

Instead of
iptables -A FORWARD -m set --match-set myset dst -j DROP

I had to use
iptables -A FORWARD -m set --match-set myset dst,dst -j DROP (two dst instead of one)