1IPTABLES(8) iptables 1.8.9 IPTABLES(8)
2
6 iptables/ip6tables — administration tool for IPv4/IPv6 packet filtering
7 and NAT
8
10 iptables [-t table] {-A|-C|-D|-V} chain rule-specification
11 ip6tables [-t table] {-A|-C|-D|-V} chain rule-specification
13 iptables [-t table] -I chain [rulenum] rule-specification
15 iptables [-t table] -R chain rulenum rule-specification
17 iptables [-t table] -D chain rulenum
19 iptables [-t table] -S [chain [rulenum]]
21 iptables [-t table] {-F|-L|-Z} [chain [rulenum]] [options...]
23 iptables [-t table] -N chain
25 iptables [-t table] -X [chain]
27 iptables [-t table] -P chain target
29 iptables [-t table] -E old-chain-name new-chain-name
31 rule-specification = [matches...] [target]
33 match = -m matchname [per-match-options]
35 target = -j targetname [per-target-options]
37
39 Iptables and ip6tables are used to set up, maintain, and inspect the
40 tables of IPv4 and IPv6 packet filter rules in the Linux kernel. Sev‐
41 eral different tables may be defined. Each table contains a number of
42 built-in chains and may also contain user-defined chains.
43 Each chain is a list of rules which can match a set of packets. Each
45 rule specifies what to do with a packet that matches. This is called a
46 `target', which may be a jump to a user-defined chain in the same ta‐
47 ble.
48
50 A firewall rule specifies criteria for a packet and a target. If the
51 packet does not match, the next rule in the chain is examined; if it
52 does match, then the next rule is specified by the value of the target,
53 which can be the name of a user-defined chain, one of the targets de‐
54 scribed in iptables-extensions(8), or one of the special values ACCEPT,
55 DROP or RETURN.
56 ACCEPT means to let the packet through. DROP means to drop the packet
58 on the floor. RETURN means stop traversing this chain and resume at
59 the next rule in the previous (calling) chain. If the end of a built-
60 in chain is reached or a rule in a built-in chain with target RETURN is
61 matched, the target specified by the chain policy determines the fate
62 of the packet.
63
65 There are currently five independent tables (which tables are present
66 at any time depends on the kernel configuration options and which mod‐
67 ules are present).
68 -t, --table table
70 This option specifies the packet matching table which the com‐
71 mand should operate on. If the kernel is configured with auto‐
72 matic module loading, an attempt will be made to load the appro‐
73 priate module for that table if it is not already there.
74 The tables are as follows:
76 filter:
78 This is the default table (if no -t option is passed). It
79 contains the built-in chains INPUT (for packets destined to
80 local sockets), FORWARD (for packets being routed through
81 the box), and OUTPUT (for locally-generated packets).
82 nat:
84 This table is consulted when a packet that creates a new
85 connection is encountered. It consists of four built-ins:
86 PREROUTING (for altering packets as soon as they come in),
87 INPUT (for altering packets destined for local sockets),
88 OUTPUT (for altering locally-generated packets before rout‐
89 ing), and POSTROUTING (for altering packets as they are
90 about to go out). IPv6 NAT support is available since ker‐
91 nel 3.7.
92 mangle:
94 This table is used for specialized packet alteration. Until
95 kernel 2.4.17 it had two built-in chains: PREROUTING (for
96 altering incoming packets before routing) and OUTPUT (for
97 altering locally-generated packets before routing). Since
98 kernel 2.4.18, three other built-in chains are also sup‐
99 ported: INPUT (for packets coming into the box itself), FOR‐
100 WARD (for altering packets being routed through the box),
101 and POSTROUTING (for altering packets as they are about to
102 go out).
103 raw:
105 This table is used mainly for configuring exemptions from
106 connection tracking in combination with the NOTRACK target.
107 It registers at the netfilter hooks with higher priority and
108 is thus called before ip_conntrack, or any other IP tables.
109 It provides the following built-in chains: PREROUTING (for
110 packets arriving via any network interface) OUTPUT (for
111 packets generated by local processes)
112 security:
114 This table is used for Mandatory Access Control (MAC) net‐
115 working rules, such as those enabled by the SECMARK and
116 CONNSECMARK targets. Mandatory Access Control is imple‐
117 mented by Linux Security Modules such as SELinux. The secu‐
118 rity table is called after the filter table, allowing any
119 Discretionary Access Control (DAC) rules in the filter table
120 to take effect before MAC rules. This table provides the
121 following built-in chains: INPUT (for packets coming into
122 the box itself), OUTPUT (for altering locally-generated
123 packets before routing), and FORWARD (for altering packets
124 being routed through the box).
125
127 The options that are recognized by iptables and ip6tables can be di‐
128 vided into several different groups.
129 COMMANDS
131 These options specify the desired action to perform. Only one of them
132 can be specified on the command line unless otherwise stated below. For
133 long versions of the command and option names, you need to use only
134 enough letters to ensure that iptables can differentiate it from all
135 other options.
136 -A, --append chain rule-specification
138 Append one or more rules to the end of the selected chain. When
139 the source and/or destination names resolve to more than one ad‐
140 dress, a rule will be added for each possible address combina‐
141 tion.
142 -C, --check chain rule-specification
144 Check whether a rule matching the specification does exist in
145 the selected chain. This command uses the same logic as -D to
146 find a matching entry, but does not alter the existing iptables
147 configuration and uses its exit code to indicate success or
148 failure.
149 -D, --delete chain rule-specification
151 -D, --delete chain rulenum
152 Delete one or more rules from the selected chain. There are two
153 versions of this command: the rule can be specified as a number
154 in the chain (starting at 1 for the first rule) or a rule to
155 match.
156 -I, --insert chain [rulenum] rule-specification
158 Insert one or more rules in the selected chain as the given rule
159 number. So, if the rule number is 1, the rule or rules are in‐
160 serted at the head of the chain. This is also the default if no
161 rule number is specified.
162 -R, --replace chain rulenum rule-specification
164 Replace a rule in the selected chain. If the source and/or des‐
165 tination names resolve to multiple addresses, the command will
166 fail. Rules are numbered starting at 1.
167 -L, --list [chain]
169 List all rules in the selected chain. If no chain is selected,
170 all chains are listed. Like every other iptables command, it ap‐
171 plies to the specified table (filter is the default), so NAT
172 rules get listed by
173 iptables -t nat -n -L
174 Please note that it is often used with the -n option, in order
175 to avoid long reverse DNS lookups. It is legal to specify the
176 -Z (zero) option as well, in which case the chain(s) will be
177 atomically listed and zeroed. The exact output is affected by
178 the other arguments given. The exact rules are suppressed until
179 you use
180 iptables -L -v
181 or iptables-save(8).
182 -S, --list-rules [chain]
184 Print all rules in the selected chain. If no chain is selected,
185 all chains are printed like iptables-save. Like every other ipt‐
186 ables command, it applies to the specified table (filter is the
187 default).
188 -F, --flush [chain]
190 Flush the selected chain (all the chains in the table if none is
191 given). This is equivalent to deleting all the rules one by
192 one.
193 -Z, --zero [chain [rulenum]]
195 Zero the packet and byte counters in all chains, or only the
196 given chain, or only the given rule in a chain. It is legal to
197 specify the -L, --list (list) option as well, to see the coun‐
198 ters immediately before they are cleared. (See above.)
199 -N, --new-chain chain
201 Create a new user-defined chain by the given name. There must
202 be no target of that name already.
203 -X, --delete-chain [chain]
205 Delete the chain specified. There must be no references to the
206 chain. If there are, you must delete or replace the referring
207 rules before the chain can be deleted. The chain must be empty,
208 i.e. not contain any rules. If no argument is given, it will
209 delete all empty chains in the table. Empty builtin chains can
210 only be deleted with iptables-nft.
211 -P, --policy chain target
213 Set the policy for the built-in (non-user-defined) chain to the
214 given target. The policy target must be either ACCEPT or DROP.
215 -E, --rename-chain old-chain new-chain
217 Rename the user specified chain to the user supplied name. This
218 is cosmetic, and has no effect on the structure of the table.
219 -h Help. Give a (currently very brief) description of the command
221 syntax.
222 PARAMETERS
224 The following parameters make up a rule specification (as used in the
225 add, delete, insert, replace and append commands).
226 -4, --ipv4
228 This option has no effect in iptables and iptables-restore. If
229 a rule using the -4 option is inserted with (and only with)
230 ip6tables-restore, it will be silently ignored. Any other uses
231 will throw an error. This option allows IPv4 and IPv6 rules in a
232 single rule file for use with both iptables-restore and ip6ta‐
233 bles-restore.
234 -6, --ipv6
236 If a rule using the -6 option is inserted with (and only with)
237 iptables-restore, it will be silently ignored. Any other uses
238 will throw an error. This option allows IPv4 and IPv6 rules in a
239 single rule file for use with both iptables-restore and ip6ta‐
240 bles-restore. This option has no effect in ip6tables and ip6ta‐
241 bles-restore.
242 [!] -p, --protocol protocol
244 The protocol of the rule or of the packet to check. The speci‐
245 fied protocol can be one of tcp, udp, udplite, icmp, icmpv6,esp,
246 ah, sctp, mh or the special keyword "all", or it can be a nu‐
247 meric value, representing one of these protocols or a different
248 one. A protocol name from /etc/protocols is also allowed. A
249 "!" argument before the protocol inverts the test. The number
250 zero is equivalent to all. "all" will match with all protocols
251 and is taken as default when this option is omitted. Note that,
252 in ip6tables, IPv6 extension headers except esp are not allowed.
253 esp and ipv6-nonext can be used with Kernel version 2.6.11 or
254 later. The number zero is equivalent to all, which means that
255 you cannot test the protocol field for the value 0 directly. To
256 match on a HBH header, even if it were the last, you cannot use
257 -p 0, but always need -m hbh.
258 [!] -s, --source address[/mask][,...]
260 Source specification. Address can be either a network name, a
261 hostname, a network IP address (with /mask), or a plain IP ad‐
262 dress. Hostnames will be resolved once only, before the rule is
263 submitted to the kernel. Please note that specifying any name
264 to be resolved with a remote query such as DNS is a really bad
265 idea. The mask can be either an ipv4 network mask (for ipta‐
266 bles) or a plain number, specifying the number of 1's at the
267 left side of the network mask. Thus, an iptables mask of 24 is
268 equivalent to 255.255.255.0. A "!" argument before the address
269 specification inverts the sense of the address. The flag --src
270 is an alias for this option. Multiple addresses can be speci‐
271 fied, but this will expand to multiple rules (when adding with
272 -A), or will cause multiple rules to be deleted (with -D).
273 [!] -d, --destination address[/mask][,...]
275 Destination specification. See the description of the -s
276 (source) flag for a detailed description of the syntax. The
277 flag --dst is an alias for this option.
278 -m, --match match
280 Specifies a match to use, that is, an extension module that
281 tests for a specific property. The set of matches make up the
282 condition under which a target is invoked. Matches are evaluated
283 first to last as specified on the command line and work in
284 short-circuit fashion, i.e. if one extension yields false, eval‐
285 uation will stop.
286 -j, --jump target
288 This specifies the target of the rule; i.e., what to do if the
289 packet matches it. The target can be a user-defined chain
290 (other than the one this rule is in), one of the special builtin
291 targets which decide the fate of the packet immediately, or an
292 extension (see MATCH AND TARGET EXTENSIONS below). If this op‐
293 tion is omitted in a rule (and -g is not used), then matching
294 the rule will have no effect on the packet's fate, but the coun‐
295 ters on the rule will be incremented.
296 -g, --goto chain
298 This specifies that the processing should continue in a user
299 specified chain. Unlike with the --jump option, RETURN will not
300 continue processing in this chain but instead in the chain that
301 called us via --jump.
302 [!] -i, --in-interface name
304 Name of an interface via which a packet was received (only for
305 packets entering the INPUT, FORWARD and PREROUTING chains).
306 When the "!" argument is used before the interface name, the
307 sense is inverted. If the interface name ends in a "+", then
308 any interface which begins with this name will match. If this
309 option is omitted, any interface name will match.
310 [!] -o, --out-interface name
312 Name of an interface via which a packet is going to be sent (for
313 packets entering the FORWARD, OUTPUT and POSTROUTING chains).
314 When the "!" argument is used before the interface name, the
315 sense is inverted. If the interface name ends in a "+", then
316 any interface which begins with this name will match. If this
317 option is omitted, any interface name will match.
318 [!] -f, --fragment
320 This means that the rule only refers to second and further IPv4
321 fragments of fragmented packets. Since there is no way to tell
322 the source or destination ports of such a packet (or ICMP type),
323 such a packet will not match any rules which specify them. When
324 the "!" argument precedes the "-f" flag, the rule will only
325 match head fragments, or unfragmented packets. This option is
326 IPv4 specific, it is not available in ip6tables.
327 -c, --set-counters packets bytes
329 This enables the administrator to initialize the packet and byte
330 counters of a rule (during INSERT, APPEND, REPLACE operations).
331 OTHER OPTIONS
333 The following additional options can be specified:
334 -v, --verbose
336 Verbose output. This option makes the list command show the in‐
337 terface name, the rule options (if any), and the TOS masks. The
338 packet and byte counters are also listed, with the suffix 'K',
339 'M' or 'G' for 1000, 1,000,000 and 1,000,000,000 multipliers re‐
340 spectively (but see the -x flag to change this). For appending,
341 insertion, deletion and replacement, this causes detailed infor‐
342 mation on the rule or rules to be printed. -v may be specified
343 multiple times to possibly emit more detailed debug statements:
344 Specified twice, iptables-legacy will dump table info and en‐
345 tries in libiptc, iptables-nft dumps rules in netlink (VM code)
346 presentation. Specified three times, iptables-nft will also
347 dump any netlink messages sent to kernel.
348 -V, --version
350 Show program version and the kernel API used.
351 -w, --wait [seconds]
353 Wait for the xtables lock. To prevent multiple instances of the
354 program from running concurrently, an attempt will be made to
355 obtain an exclusive lock at launch. By default, the program
356 will exit if the lock cannot be obtained. This option will make
357 the program wait (indefinitely or for optional seconds) until
358 the exclusive lock can be obtained.
359 -n, --numeric
361 Numeric output. IP addresses and port numbers will be printed
362 in numeric format. By default, the program will try to display
363 them as host names, network names, or services (whenever appli‐
364 cable).
365 -x, --exact
367 Expand numbers. Display the exact value of the packet and byte
368 counters, instead of only the rounded number in K's (multiples
369 of 1000) M's (multiples of 1000K) or G's (multiples of 1000M).
370 This option is only relevant for the -L command.
371 --line-numbers
373 When listing rules, add line numbers to the beginning of each
374 rule, corresponding to that rule's position in the chain.
375 --modprobe=command
377 When adding or inserting rules into a chain, use command to load
378 any necessary modules (targets, match extensions, etc).
379
382 iptables uses the /run/xtables.lock file to take an exclusive lock at
383 launch.
384 The XTABLES_LOCKFILE environment variable can be used to override the
386 default setting.
387
390 iptables can use extended packet matching and target modules. A list
391 of these is available in the iptables-extensions(8) manpage.
392
394 Various error messages are printed to standard error. The exit code is
395 0 for correct functioning. Errors which appear to be caused by invalid
396 or abused command line parameters cause an exit code of 2, and other
397 errors cause an exit code of 1.
398
400 Bugs? What's this? ;-) Well, you might want to have a look at
401 http://bugzilla.netfilter.org/ iptables will exit immediately with an
402 error code of 111 if it finds that it was called as a setuid-to-root
403 program. iptables cannot be used safely in this manner because it
404 trusts the shared libraries (matches, targets) loaded at run time, the
405 search path can be set using environment variables.
406
408 This iptables is very similar to ipchains by Rusty Russell. The main
409 difference is that the chains INPUT and OUTPUT are only traversed for
410 packets coming into the local host and originating from the local host
411 respectively. Hence every packet only passes through one of the three
412 chains (except loopback traffic, which involves both INPUT and OUTPUT
413 chains); previously a forwarded packet would pass through all three.
414 The other main difference is that -i refers to the input interface; -o
416 refers to the output interface, and both are available for packets en‐
417 tering the FORWARD chain.
418 The various forms of NAT have been separated out; iptables is a pure
420 packet filter when using the default `filter' table, with optional ex‐
421 tension modules. This should simplify much of the previous confusion
422 over the combination of IP masquerading and packet filtering seen pre‐
423 viously. So the following options are handled differently:
424 -j MASQ
425 -M -S
426 -M -L
427 There are several other changes in iptables.
428
430 iptables-apply(8), iptables-save(8), iptables-restore(8), iptables-ex‐
431 tensions(8),
432 The packet-filtering-HOWTO details iptables usage for packet filtering,
434 the NAT-HOWTO details NAT, the netfilter-extensions-HOWTO details the
435 extensions that are not in the standard distribution, and the netfil‐
436 ter-hacking-HOWTO details the netfilter internals.
437 See http://www.netfilter.org/.
438
440 Rusty Russell originally wrote iptables, in early consultation with
441 Michael Neuling.
442 Marc Boucher made Rusty abandon ipnatctl by lobbying for a generic
444 packet selection framework in iptables, then wrote the mangle table,
445 the owner match, the mark stuff, and ran around doing cool stuff every‐
446 where.
447 James Morris wrote the TOS target, and tos match.
449 Jozsef Kadlecsik wrote the REJECT target.
451 Harald Welte wrote the ULOG and NFQUEUE target, the new libiptc, as
453 well as the TTL, DSCP, ECN matches and targets.
454 The Netfilter Core Team is: Jozsef Kadlecsik, Pablo Neira Ayuso, Eric
456 Leblond, Florian Westphal and Arturo Borrero Gonzalez. Emeritus Core
457 Team members are: Marc Boucher, Martin Josefsson, Yasuyuki Kozakai,
458 James Morris, Harald Welte and Rusty Russell.
459 Man page originally written by Herve Eychenne <rv@wallfire.org>.
461
463 This manual page applies to iptables/ip6tables 1.8.9.
464iptables 1.8.9 IPTABLES(8)