1IPTABLES(8) iptables 1.4.9 IPTABLES(8)
2
6 iptables — administration tool for IPv4 packet filtering and NAT
7
9 iptables [-t table] {-A|-D} chain rule-specification
10 iptables [-t table] -I chain [rulenum] rule-specification
12 iptables [-t table] -R chain rulenum rule-specification
14 iptables [-t table] -D chain rulenum
16 iptables [-t table] -S [chain [rulenum]]
18 iptables [-t table] {-F|-L|-Z} [chain [rulenum]] [options...]
20 iptables [-t table] -N chain
22 iptables [-t table] -X [chain]
24 iptables [-t table] -P chain target
26 iptables [-t table] -E old-chain-name new-chain-name
28 rule-specification = [matches...] [target]
30 match = -m matchname [per-match-options]
32 target = -j targetname [per-target-options]
34
36 Iptables is used to set up, maintain, and inspect the tables of IPv4
37 packet filter rules in the Linux kernel. Several different tables may
38 be defined. Each table contains a number of built-in chains and may
39 also contain user-defined chains.
40 Each chain is a list of rules which can match a set of packets. Each
42 rule specifies what to do with a packet that matches. This is called a
43 `target', which may be a jump to a user-defined chain in the same ta‐
44 ble.
45
47 A firewall rule specifies criteria for a packet and a target. If the
48 packet does not match, the next rule in the chain is the examined; if
49 it does match, then the next rule is specified by the value of the tar‐
50 get, which can be the name of a user-defined chain or one of the spe‐
51 cial values ACCEPT, DROP, QUEUE or RETURN.
52 ACCEPT means to let the packet through. DROP means to drop the packet
54 on the floor. QUEUE means to pass the packet to userspace. (How the
55 packet can be received by a userspace process differs by the particular
56 queue handler. 2.4.x and 2.6.x kernels up to 2.6.13 include the
57 ip_queue queue handler. Kernels 2.6.14 and later additionally include
58 the nfnetlink_queue queue handler. Packets with a target of QUEUE will
59 be sent to queue number '0' in this case. Please also see the NFQUEUE
60 target as described later in this man page.) RETURN means stop
61 traversing this chain and resume at the next rule in the previous
62 (calling) chain. If the end of a built-in chain is reached or a rule
63 in a built-in chain with target RETURN is matched, the target specified
64 by the chain policy determines the fate of the packet.
65
67 There are currently three independent tables (which tables are present
68 at any time depends on the kernel configuration options and which mod‐
69 ules are present).
70 -t, --table table
72 This option specifies the packet matching table which the com‐
73 mand should operate on. If the kernel is configured with auto‐
74 matic module loading, an attempt will be made to load the appro‐
75 priate module for that table if it is not already there.
76 The tables are as follows:
78 filter:
80 This is the default table (if no -t option is passed). It
81 contains the built-in chains INPUT (for packets destined to
82 local sockets), FORWARD (for packets being routed through
83 the box), and OUTPUT (for locally-generated packets).
84 nat:
86 This table is consulted when a packet that creates a new
87 connection is encountered. It consists of three built-ins:
88 PREROUTING (for altering packets as soon as they come in),
89 OUTPUT (for altering locally-generated packets before rout‐
90 ing), and POSTROUTING (for altering packets as they are
91 about to go out).
92 mangle:
94 This table is used for specialized packet alteration. Until
95 kernel 2.4.17 it had two built-in chains: PREROUTING (for
96 altering incoming packets before routing) and OUTPUT (for
97 altering locally-generated packets before routing). Since
98 kernel 2.4.18, three other built-in chains are also sup‐
99 ported: INPUT (for packets coming into the box itself), FOR‐
100 WARD (for altering packets being routed through the box),
101 and POSTROUTING (for altering packets as they are about to
102 go out).
103 raw:
105 This table is used mainly for configuring exemptions from
106 connection tracking in combination with the NOTRACK target.
107 It registers at the netfilter hooks with higher priority and
108 is thus called before ip_conntrack, or any other IP tables.
109 It provides the following built-in chains: PREROUTING (for
110 packets arriving via any network interface) OUTPUT (for
111 packets generated by local processes)
112
114 The options that are recognized by iptables can be divided into several
115 different groups.
116 COMMANDS
118 These options specify the desired action to perform. Only one of them
119 can be specified on the command line unless otherwise stated below. For
120 long versions of the command and option names, you need to use only
121 enough letters to ensure that iptables can differentiate it from all
122 other options.
123 -A, --append chain rule-specification
125 Append one or more rules to the end of the selected chain. When
126 the source and/or destination names resolve to more than one
127 address, a rule will be added for each possible address combina‐
128 tion.
129 -D, --delete chain rule-specification
131 -D, --delete chain rulenum
132 Delete one or more rules from the selected chain. There are two
133 versions of this command: the rule can be specified as a number
134 in the chain (starting at 1 for the first rule) or a rule to
135 match.
136 -I, --insert chain [rulenum] rule-specification
138 Insert one or more rules in the selected chain as the given rule
139 number. So, if the rule number is 1, the rule or rules are
140 inserted at the head of the chain. This is also the default if
141 no rule number is specified.
142 -R, --replace chain rulenum rule-specification
144 Replace a rule in the selected chain. If the source and/or des‐
145 tination names resolve to multiple addresses, the command will
146 fail. Rules are numbered starting at 1.
147 -L, --list [chain]
149 List all rules in the selected chain. If no chain is selected,
150 all chains are listed. Like every other iptables command, it
151 applies to the specified table (filter is the default), so NAT
152 rules get listed by
153 iptables -t nat -n -L
154 Please note that it is often used with the -n option, in order
155 to avoid long reverse DNS lookups. It is legal to specify the
156 -Z (zero) option as well, in which case the chain(s) will be
157 atomically listed and zeroed. The exact output is affected by
158 the other arguments given. The exact rules are suppressed until
159 you use
160 iptables -L -v
161 -S, --list-rules [chain]
163 Print all rules in the selected chain. If no chain is selected,
164 all chains are printed like iptables-save. Like every other ipt‐
165 ables command, it applies to the specified table (filter is the
166 default).
167 -F, --flush [chain]
169 Flush the selected chain (all the chains in the table if none is
170 given). This is equivalent to deleting all the rules one by
171 one.
172 -Z, --zero [chain [rulenum]]
174 Zero the packet and byte counters in all chains, or only the
175 given chain, or only the given rule in a chain. It is legal to
176 specify the -L, --list (list) option as well, to see the coun‐
177 ters immediately before they are cleared. (See above.)
178 -N, --new-chain chain
180 Create a new user-defined chain by the given name. There must
181 be no target of that name already.
182 -X, --delete-chain [chain]
184 Delete the optional user-defined chain specified. There must be
185 no references to the chain. If there are, you must delete or
186 replace the referring rules before the chain can be deleted.
187 The chain must be empty, i.e. not contain any rules. If no
188 argument is given, it will attempt to delete every non-builtin
189 chain in the table.
190 -P, --policy chain target
192 Set the policy for the chain to the given target. See the sec‐
193 tion TARGETS for the legal targets. Only built-in (non-user-
194 defined) chains can have policies, and neither built-in nor
195 user-defined chains can be policy targets.
196 -E, --rename-chain old-chain new-chain
198 Rename the user specified chain to the user supplied name. This
199 is cosmetic, and has no effect on the structure of the table.
200 -h Help. Give a (currently very brief) description of the command
202 syntax.
203 PARAMETERS
205 The following parameters make up a rule specification (as used in the
206 add, delete, insert, replace and append commands).
207 [!] -p, --protocol protocol
209 The protocol of the rule or of the packet to check. The speci‐
210 fied protocol can be one of tcp, udp, udplite, icmp, esp, ah,
211 sctp or all, or it can be a numeric value, representing one of
212 these protocols or a different one. A protocol name from
213 /etc/protocols is also allowed. A "!" argument before the pro‐
214 tocol inverts the test. The number zero is equivalent to all.
215 Protocol all will match with all protocols and is taken as
216 default when this option is omitted.
217 [!] -s, --source address[/mask][,...]
219 Source specification. Address can be either a network name, a
220 hostname, a network IP address (with /mask), or a plain IP
221 address. Hostnames will be resolved once only, before the rule
222 is submitted to the kernel. Please note that specifying any
223 name to be resolved with a remote query such as DNS is a really
224 bad idea. The mask can be either a network mask or a plain num‐
225 ber, specifying the number of 1's at the left side of the net‐
226 work mask. Thus, a mask of 24 is equivalent to 255.255.255.0.
227 A "!" argument before the address specification inverts the
228 sense of the address. The flag --src is an alias for this
229 option. Multiple addresses can be specified, but this will
230 expand to multiple rules (when adding with -A), or will cause
231 multiple rules to be deleted (with -D).
232 [!] -d, --destination address[/mask][,...]
234 Destination specification. See the description of the -s
235 (source) flag for a detailed description of the syntax. The
236 flag --dst is an alias for this option.
237 -j, --jump target
239 This specifies the target of the rule; i.e., what to do if the
240 packet matches it. The target can be a user-defined chain
241 (other than the one this rule is in), one of the special builtin
242 targets which decide the fate of the packet immediately, or an
243 extension (see EXTENSIONS below). If this option is omitted in
244 a rule (and -g is not used), then matching the rule will have no
245 effect on the packet's fate, but the counters on the rule will
246 be incremented.
247 -g, --goto chain
249 This specifies that the processing should continue in a user
250 specified chain. Unlike the --jump option return will not con‐
251 tinue processing in this chain but instead in the chain that
252 called us via --jump.
253 [!] -i, --in-interface name
255 Name of an interface via which a packet was received (only for
256 packets entering the INPUT, FORWARD and PREROUTING chains).
257 When the "!" argument is used before the interface name, the
258 sense is inverted. If the interface name ends in a "+", then
259 any interface which begins with this name will match. If this
260 option is omitted, any interface name will match.
261 [!] -o, --out-interface name
263 Name of an interface via which a packet is going to be sent (for
264 packets entering the FORWARD, OUTPUT and POSTROUTING chains).
265 When the "!" argument is used before the interface name, the
266 sense is inverted. If the interface name ends in a "+", then
267 any interface which begins with this name will match. If this
268 option is omitted, any interface name will match.
269 [!] -f, --fragment
271 This means that the rule only refers to second and further frag‐
272 ments of fragmented packets. Since there is no way to tell the
273 source or destination ports of such a packet (or ICMP type),
274 such a packet will not match any rules which specify them. When
275 the "!" argument precedes the "-f" flag, the rule will only
276 match head fragments, or unfragmented packets.
277 -c, --set-counters packets bytes
279 This enables the administrator to initialize the packet and byte
280 counters of a rule (during INSERT, APPEND, REPLACE operations).
281 OTHER OPTIONS
283 The following additional options can be specified:
284 -v, --verbose
286 Verbose output. This option makes the list command show the
287 interface name, the rule options (if any), and the TOS masks.
288 The packet and byte counters are also listed, with the suffix
289 'K', 'M' or 'G' for 1000, 1,000,000 and 1,000,000,000 multipli‐
290 ers respectively (but see the -x flag to change this). For
291 appending, insertion, deletion and replacement, this causes
292 detailed information on the rule or rules to be printed.
293 -n, --numeric
295 Numeric output. IP addresses and port numbers will be printed
296 in numeric format. By default, the program will try to display
297 them as host names, network names, or services (whenever appli‐
298 cable).
299 -x, --exact
301 Expand numbers. Display the exact value of the packet and byte
302 counters, instead of only the rounded number in K's (multiples
303 of 1000) M's (multiples of 1000K) or G's (multiples of 1000M).
304 This option is only relevant for the -L command.
305 --line-numbers
307 When listing rules, add line numbers to the beginning of each
308 rule, corresponding to that rule's position in the chain.
309 --modprobe=command
311 When adding or inserting rules into a chain, use command to load
312 any necessary modules (targets, match extensions, etc).
313
315 iptables can use extended packet matching modules. These are loaded in
316 two ways: implicitly, when -p or --protocol is specified, or with the
317 -m or --match options, followed by the matching module name; after
318 these, various extra command line options become available, depending
319 on the specific module. You can specify multiple extended match mod‐
320 ules in one line, and you can use the -h or --help options after the
321 module has been specified to receive help specific to that module.
322 The following are included in the base package, and most of these can
324 be preceded by a "!" to invert the sense of the match.
325 addrtype
327 This module matches packets based on their address type. Address types
328 are used within the kernel networking stack and categorize addresses
329 into various groups. The exact definition of that group depends on the
330 specific layer three protocol.
331 The following address types are possible:
333 UNSPEC an unspecified address (i.e. 0.0.0.0)
335 UNICAST
337 an unicast address
338 LOCAL a local address
340 BROADCAST
342 a broadcast address
343 ANYCAST
345 an anycast packet
346 MULTICAST
348 a multicast address
349 BLACKHOLE
351 a blackhole address
352 UNREACHABLE
354 an unreachable address
355 PROHIBIT
357 a prohibited address
358 THROW FIXME
360 NAT FIXME
362 XRESOLVE
364 [!] --src-type type
366 Matches if the source address is of given type
367 [!] --dst-type type
369 Matches if the destination address is of given type
370 --limit-iface-in
372 The address type checking can be limited to the interface the
373 packet is coming in. This option is only valid in the PREROUT‐
374 ING, INPUT and FORWARD chains. It cannot be specified with the
375 --limit-iface-out option.
376 --limit-iface-out
378 The address type checking can be limited to the interface the
379 packet is going out. This option is only valid in the POSTROUT‐
380 ING, OUTPUT and FORWARD chains. It cannot be specified with the
381 --limit-iface-in option.
382 ah
384 This module matches the SPIs in Authentication header of IPsec packets.
385 [!] --ahspi spi[:spi]
387 cluster
389 Allows you to deploy gateway and back-end load-sharing clusters without
390 the need of load-balancers.
391 This match requires that all the nodes see the same packets. Thus, the
393 cluster match decides if this node has to handle a packet given the
394 following options:
395 --cluster-total-nodes num
397 Set number of total nodes in cluster.
398 [!] --cluster-local-node num
400 Set the local node number ID.
401 [!] --cluster-local-nodemask mask
403 Set the local node number ID mask. You can use this option
404 instead of --cluster-local-node.
405 --cluster-hash-seed value
407 Set seed value of the Jenkins hash.
408 Example:
410 iptables -A PREROUTING -t mangle -i eth1 -m cluster --clus‐
412 ter-total-nodes 2 --cluster-local-node 1 --cluster-hash-seed
413 0xdeadbeef -j MARK --set-mark 0xffff
414 iptables -A PREROUTING -t mangle -i eth2 -m cluster --clus‐
416 ter-total-nodes 2 --cluster-local-node 1 --cluster-hash-seed
417 0xdeadbeef -j MARK --set-mark 0xffff
418 iptables -A PREROUTING -t mangle -i eth1 -m mark ! --mark 0xffff
420 -j DROP
421 iptables -A PREROUTING -t mangle -i eth2 -m mark ! --mark 0xffff
423 -j DROP
424 And the following commands to make all nodes see the same packets:
426 ip maddr add 01:00:5e:00:01:01 dev eth1
428 ip maddr add 01:00:5e:00:01:02 dev eth2
430 arptables -A OUTPUT -o eth1 --h-length 6 -j mangle --mangle-mac-
432 s 01:00:5e:00:01:01
433 arptables -A INPUT -i eth1 --h-length 6 --destination-mac
435 01:00:5e:00:01:01 -j mangle --mangle-mac-d 00:zz:yy:xx:5a:27
436 arptables -A OUTPUT -o eth2 --h-length 6 -j mangle --man‐
438 gle-mac-s 01:00:5e:00:01:02
439 arptables -A INPUT -i eth2 --h-length 6 --destination-mac
441 01:00:5e:00:01:02 -j mangle --mangle-mac-d 00:zz:yy:xx:5a:27
442 In the case of TCP connections, pickup facility has to be disabled to
444 avoid marking TCP ACK packets coming in the reply direction as valid.
445 echo 0 > /proc/sys/net/netfilter/nf_conntrack_tcp_loose
447 comment
449 Allows you to add comments (up to 256 characters) to any rule.
450 --comment comment
452 Example:
454 iptables -A INPUT -i eth1 -m comment --comment "my local LAN"
455 connbytes
457 Match by how many bytes or packets a connection (or one of the two
458 flows constituting the connection) has transferred so far, or by aver‐
459 age bytes per packet.
460 The counters are 64-bit and are thus not expected to overflow ;)
462 The primary use is to detect long-lived downloads and mark them to be
464 scheduled using a lower priority band in traffic control.
465 The transferred bytes per connection can also be viewed through `con‐
467 ntrack -L` and accessed via ctnetlink.
468 NOTE that for connections which have no accounting information, the
470 match will always return false. The "net.netfilter.nf_conntrack_acct"
471 sysctl flag controls whether new connections will be byte/packet
472 counted. Existing connection flows will not be gaining/losing a/the
473 accounting structure when be sysctl flag is flipped.
474 [!] --connbytes from[:to]
476 match packets from a connection whose packets/bytes/average
477 packet size is more than FROM and less than TO bytes/packets. if
478 TO is omitted only FROM check is done. "!" is used to match
479 packets not falling in the range.
480 --connbytes-dir {original|reply|both}
482 which packets to consider
483 --connbytes-mode {packets|bytes|avgpkt}
485 whether to check the amount of packets, number of bytes trans‐
486 ferred or the average size (in bytes) of all packets received so
487 far. Note that when "both" is used together with "avgpkt", and
488 data is going (mainly) only in one direction (for example HTTP),
489 the average packet size will be about half of the actual data
490 packets.
491 Example:
493 iptables .. -m connbytes --connbytes 10000:100000
494 --connbytes-dir both --connbytes-mode bytes ...
495 connlimit
497 Allows you to restrict the number of parallel connections to a server
498 per client IP address (or client address block).
499 [!] --connlimit-above n
501 Match if the number of existing connections is (not) above n.
502 --connlimit-mask prefix_length
504 Group hosts using the prefix length. For IPv4, this must be a
505 number between (including) 0 and 32. For IPv6, between 0 and
506 128.
507 Examples:
509 # allow 2 telnet connections per client host
511 iptables -A INPUT -p tcp --syn --dport 23 -m connlimit
512 --connlimit-above 2 -j REJECT
513 # you can also match the other way around:
515 iptables -A INPUT -p tcp --syn --dport 23 -m connlimit !
516 --connlimit-above 2 -j ACCEPT
517 # limit the number of parallel HTTP requests to 16 per class C sized
519 network (24 bit netmask)
520 iptables -p tcp --syn --dport 80 -m connlimit --connlimit-above
521 16 --connlimit-mask 24 -j REJECT
522 # limit the number of parallel HTTP requests to 16 for the link local
524 network
525 (ipv6) ip6tables -p tcp --syn --dport 80 -s fe80::/64 -m
526 connlimit --connlimit-above 16 --connlimit-mask 64 -j REJECT
527 connmark
529 This module matches the netfilter mark field associated with a connec‐
530 tion (which can be set using the CONNMARK target below).
531 [!] --mark value[/mask]
533 Matches packets in connections with the given mark value (if a
534 mask is specified, this is logically ANDed with the mark before
535 the comparison).
536 conntrack
538 This module, when combined with connection tracking, allows access to
539 the connection tracking state for this packet/connection.
540 [!] --ctstate statelist
542 statelist is a comma separated list of the connection states to
543 match. Possible states are listed below.
544 [!] --ctproto l4proto
546 Layer-4 protocol to match (by number or name)
547 [!] --ctorigsrc address[/mask]
549 [!] --ctorigdst address[/mask]
551 [!] --ctreplsrc address[/mask]
553 [!] --ctrepldst address[/mask]
555 Match against original/reply source/destination address
556 [!] --ctorigsrcport port
558 [!] --ctorigdstport port
560 [!] --ctreplsrcport port
562 [!] --ctrepldstport port
564 Match against original/reply source/destination port
565 (TCP/UDP/etc.) or GRE key.
566 [!] --ctstatus statelist
568 statuslist is a comma separated list of the connection statuses
569 to match. Possible statuses are listed below.
570 [!] --ctexpire time[:time]
572 Match remaining lifetime in seconds against given value or range
573 of values (inclusive)
574 --ctdir {ORIGINAL|REPLY}
576 Match packets that are flowing in the specified direction. If
577 this flag is not specified at all, matches packets in both
578 directions.
579 States for --ctstate:
581 INVALID
583 meaning that the packet is associated with no known connection
584 NEW meaning that the packet has started a new connection, or other‐
586 wise associated with a connection which has not seen packets in
587 both directions, and
588 ESTABLISHED
590 meaning that the packet is associated with a connection which
591 has seen packets in both directions,
592 RELATED
594 meaning that the packet is starting a new connection, but is
595 associated with an existing connection, such as an FTP data
596 transfer, or an ICMP error.
597 UNTRACKED
599 meaning that the packet is not tracked at all, which happens if
600 you use the NOTRACK target in raw table.
601 SNAT A virtual state, matching if the original source address differs
603 from the reply destination.
604 DNAT A virtual state, matching if the original destination differs
606 from the reply source.
607 Statuses for --ctstatus:
609 NONE None of the below.
611 EXPECTED
613 This is an expected connection (i.e. a conntrack helper set it
614 up)
615 SEEN_REPLY
617 Conntrack has seen packets in both directions.
618 ASSURED
620 Conntrack entry should never be early-expired.
621 CONFIRMED
623 Connection is confirmed: originating packet has left box.
624 dccp
626 [!] --source-port,--sport port[:port]
627 [!] --destination-port,--dport port[:port]
629 [!] --dccp-types mask
631 Match when the DCCP packet type is one of 'mask'. 'mask' is a
632 comma-separated list of packet types. Packet types are: REQUEST
633 RESPONSE DATA ACK DATAACK CLOSEREQ CLOSE RESET SYNC SYNCACK
634 INVALID.
635 [!] --dccp-option number
637 Match if DCP option set.
638 dscp
640 This module matches the 6 bit DSCP field within the TOS field in the IP
641 header. DSCP has superseded TOS within the IETF.
642 [!] --dscp value
644 Match against a numeric (decimal or hex) value [0-63].
645 [!] --dscp-class class
647 Match the DiffServ class. This value may be any of the BE, EF,
648 AFxx or CSx classes. It will then be converted into its accord‐
649 ing numeric value.
650 ecn
652 This allows you to match the ECN bits of the IPv4 and TCP header. ECN
653 is the Explicit Congestion Notification mechanism as specified in
654 RFC3168
655 [!] --ecn-tcp-cwr
657 This matches if the TCP ECN CWR (Congestion Window Received) bit
658 is set.
659 [!] --ecn-tcp-ece
661 This matches if the TCP ECN ECE (ECN Echo) bit is set.
662 [!] --ecn-ip-ect num
664 This matches a particular IPv4 ECT (ECN-Capable Transport). You
665 have to specify a number between `0' and `3'.
666 esp
668 This module matches the SPIs in ESP header of IPsec packets.
669 [!] --espspi spi[:spi]
671 hashlimit
673 hashlimit uses hash buckets to express a rate limiting match (like the
674 limit match) for a group of connections using a single iptables rule.
675 Grouping can be done per-hostgroup (source and/or destination address)
676 and/or per-port. It gives you the ability to express "N packets per
677 time quantum per group":
678 matching on source host
680 "1000 packets per second for every host in 192.168.0.0/16"
681 matching on source port
683 "100 packets per second for every service of 192.168.1.1"
684 matching on subnet
686 "10000 packets per minute for every /28 subnet in 10.0.0.0/8"
687 A hash limit option (--hashlimit-upto, --hashlimit-above) and --hash‐
689 limit-name are required.
690 --hashlimit-upto amount[/second|/minute|/hour|/day]
692 Match if the rate is below or equal to amount/quantum. It is
693 specified as a number, with an optional time quantum suffix; the
694 default is 3/hour.
695 --hashlimit-above amount[/second|/minute|/hour|/day]
697 Match if the rate is above amount/quantum.
698 --hashlimit-burst amount
700 Maximum initial number of packets to match: this number gets
701 recharged by one every time the limit specified above is not
702 reached, up to this number; the default is 5.
703 --hashlimit-mode {srcip|srcport|dstip|dstport},...
705 A comma-separated list of objects to take into consideration. If
706 no --hashlimit-mode option is given, hashlimit acts like limit,
707 but at the expensive of doing the hash housekeeping.
708 --hashlimit-srcmask prefix
710 When --hashlimit-mode srcip is used, all source addresses
711 encountered will be grouped according to the given prefix length
712 and the so-created subnet will be subject to hashlimit. prefix
713 must be between (inclusive) 0 and 32. Note that --hashlimit-src‐
714 mask 0 is basically doing the same thing as not specifying srcip
715 for --hashlimit-mode, but is technically more expensive.
716 --hashlimit-dstmask prefix
718 Like --hashlimit-srcmask, but for destination addresses.
719 --hashlimit-name foo
721 The name for the /proc/net/ipt_hashlimit/foo entry.
722 --hashlimit-htable-size buckets
724 The number of buckets of the hash table
725 --hashlimit-htable-max entries
727 Maximum entries in the hash.
728 --hashlimit-htable-expire msec
730 After how many milliseconds do hash entries expire.
731 --hashlimit-htable-gcinterval msec
733 How many milliseconds between garbage collection intervals.
734 helper
736 This module matches packets related to a specific conntrack-helper.
737 [!] --helper string
739 Matches packets related to the specified conntrack-helper.
740 string can be "ftp" for packets related to a ftp-session on
742 default port. For other ports append -portnr to the value, ie.
743 "ftp-2121".
744 Same rules apply for other conntrack-helpers.
746 icmp
748 This extension can be used if `--protocol icmp' is specified. It pro‐
749 vides the following option:
750 [!] --icmp-type {type[/code]|typename}
752 This allows specification of the ICMP type, which can be a
753 numeric ICMP type, type/code pair, or one of the ICMP type names
754 shown by the command
755 iptables -p icmp -h
756 iprange
758 This matches on a given arbitrary range of IP addresses.
759 [!] --src-range from[-to]
761 Match source IP in the specified range.
762 [!] --dst-range from[-to]
764 Match destination IP in the specified range.
765 length
767 This module matches the length of the layer-3 payload (e.g. layer-4
768 packet) of a packet against a specific value or range of values.
769 [!] --length length[:length]
771 limit
773 This module matches at a limited rate using a token bucket filter. A
774 rule using this extension will match until this limit is reached
775 (unless the `!' flag is used). It can be used in combination with the
776 LOG target to give limited logging, for example.
777 --limit rate[/second|/minute|/hour|/day]
779 Maximum average matching rate: specified as a number, with an
780 optional `/second', `/minute', `/hour', or `/day' suffix; the
781 default is 3/hour.
782 --limit-burst number
784 Maximum initial number of packets to match: this number gets
785 recharged by one every time the limit specified above is not
786 reached, up to this number; the default is 5.
787 mac
789 [!] --mac-source address
790 Match source MAC address. It must be of the form
791 XX:XX:XX:XX:XX:XX. Note that this only makes sense for packets
792 coming from an Ethernet device and entering the PREROUTING, FOR‐
793 WARD or INPUT chains.
794 mark
796 This module matches the netfilter mark field associated with a packet
797 (which can be set using the MARK target below).
798 [!] --mark value[/mask]
800 Matches packets with the given unsigned mark value (if a mask is
801 specified, this is logically ANDed with the mask before the com‐
802 parison).
803 multiport
805 This module matches a set of source or destination ports. Up to 15
806 ports can be specified. A port range (port:port) counts as two ports.
807 It can only be used in conjunction with -p tcp or -p udp.
808 [!] --source-ports,--sports port[,port|,port:port]...
810 Match if the source port is one of the given ports. The flag
811 --sports is a convenient alias for this option. Multiple ports
812 or port ranges are separated using a comma, and a port range is
813 specified using a colon. 53,1024:65535 would therefore match
814 ports 53 and all from 1024 through 65535.
815 [!] --destination-ports,--dports port[,port|,port:port]...
817 Match if the destination port is one of the given ports. The
818 flag --dports is a convenient alias for this option.
819 [!] --ports port[,port|,port:port]...
821 Match if either the source or destination ports are equal to one
822 of the given ports.
823 osf
825 The osf module does passive operating system fingerprinting. This mod‐
826 ules compares some data (Window Size, MSS, options and their order,
827 TTL, DF, and others) from packets with the SYN bit set.
828 [!] --genre string
830 Match an operating system genre by using a passive fingerprint‐
831 ing.
832 --ttl level
834 Do additional TTL checks on the packet to determine the operat‐
835 ing system. level can be one of the following values:
836 · 0 - True IP address and fingerprint TTL comparison. This generally
838 works for LANs.
839 · 1 - Check if the IP header's TTL is less than the fingerprint one.
841 Works for globally-routable addresses.
842 · 2 - Do not compare the TTL at all.
844 --log level
846 Log determined genres into dmesg even if they do not match the
847 desired one. level can be one of the following values:
848 · 0 - Log all matched or unknown signatures
850 · 1 - Log only the first one
852 · 2 - Log all known matched signatures
854 You may find something like this in syslog:
856 Windows [2000:SP3:Windows XP Pro SP1, 2000 SP3]: 11.22.33.55:4024 ->
858 11.22.33.44:139 hops=3 Linux [2.5-2.6:] : 1.2.3.4:42624 -> 1.2.3.5:22
859 hops=4
860 OS fingerprints are loadable using the nfnl_osf program. To load fin‐
862 gerprints from a file, use:
863 nfnl_osf -f /usr/share/xtables/pf.os
865 To remove them again,
867 nfnl_osf -f /usr/share/xtables/pf.os -d
869 The fingerprint database can be downlaoded from http://www.open‐
871 bsd.org/cgi-bin/cvsweb/src/etc/pf.os .
872 owner
874 This module attempts to match various characteristics of the packet
875 creator, for locally generated packets. This match is only valid in the
876 OUTPUT and POSTROUTING chains. Forwarded packets do not have any socket
877 associated with them. Packets from kernel threads do have a socket, but
878 usually no owner.
879 [!] --uid-owner username
881 [!] --uid-owner userid[-userid]
883 Matches if the packet socket's file structure (if it has one) is
884 owned by the given user. You may also specify a numerical UID,
885 or an UID range.
886 [!] --gid-owner groupname
888 [!] --gid-owner groupid[-groupid]
890 Matches if the packet socket's file structure is owned by the
891 given group. You may also specify a numerical GID, or a GID
892 range.
893 [!] --socket-exists
895 Matches if the packet is associated with a socket.
896 physdev
898 This module matches on the bridge port input and output devices
899 enslaved to a bridge device. This module is a part of the infrastruc‐
900 ture that enables a transparent bridging IP firewall and is only useful
901 for kernel versions above version 2.5.44.
902 [!] --physdev-in name
904 Name of a bridge port via which a packet is received (only for
905 packets entering the INPUT, FORWARD and PREROUTING chains). If
906 the interface name ends in a "+", then any interface which
907 begins with this name will match. If the packet didn't arrive
908 through a bridge device, this packet won't match this option,
909 unless '!' is used.
910 [!] --physdev-out name
912 Name of a bridge port via which a packet is going to be sent
913 (for packets entering the FORWARD, OUTPUT and POSTROUTING
914 chains). If the interface name ends in a "+", then any inter‐
915 face which begins with this name will match. Note that in the
916 nat and mangle OUTPUT chains one cannot match on the bridge out‐
917 put port, however one can in the filter OUTPUT chain. If the
918 packet won't leave by a bridge device or if it is yet unknown
919 what the output device will be, then the packet won't match this
920 option, unless '!' is used.
921 [!] --physdev-is-in
923 Matches if the packet has entered through a bridge interface.
924 [!] --physdev-is-out
926 Matches if the packet will leave through a bridge interface.
927 [!] --physdev-is-bridged
929 Matches if the packet is being bridged and therefore is not
930 being routed. This is only useful in the FORWARD and POSTROUT‐
931 ING chains.
932 pkttype
934 This module matches the link-layer packet type.
935 [!] --pkt-type {unicast|broadcast|multicast}
937 policy
939 This modules matches the policy used by IPsec for handling a packet.
940 --dir {in|out}
942 Used to select whether to match the policy used for decapsula‐
943 tion or the policy that will be used for encapsulation. in is
944 valid in the PREROUTING, INPUT and FORWARD chains, out is valid
945 in the POSTROUTING, OUTPUT and FORWARD chains.
946 --pol {none|ipsec}
948 Matches if the packet is subject to IPsec processing.
949 --strict
951 Selects whether to match the exact policy or match if any rule
952 of the policy matches the given policy.
953 [!] --reqid id
955 Matches the reqid of the policy rule. The reqid can be specified
956 with setkey(8) using unique:id as level.
957 [!] --spi spi
959 Matches the SPI of the SA.
960 [!] --proto {ah|esp|ipcomp}
962 Matches the encapsulation protocol.
963 [!] --mode {tunnel|transport}
965 Matches the encapsulation mode.
966 [!] --tunnel-src addr[/mask]
968 Matches the source end-point address of a tunnel mode SA. Only
969 valid with --mode tunnel.
970 [!] --tunnel-dst addr[/mask]
972 Matches the destination end-point address of a tunnel mode SA.
973 Only valid with --mode tunnel.
974 --next Start the next element in the policy specification. Can only be
976 used with --strict.
977 quota
979 Implements network quotas by decrementing a byte counter with each
980 packet.
981 [!] --quota bytes
983 The quota in bytes.
984 rateest
986 The rate estimator can match on estimated rates as collected by the
987 RATEEST target. It supports matching on absolute bps/pps values, com‐
988 paring two rate estimators and matching on the difference between two
989 rate estimators.
990 --rateest1 name
992 Name of the first rate estimator.
993 --rateest2 name
995 Name of the second rate estimator (if difference is to be calcu‐
996 lated).
997 --rateest-delta
999 Compare difference(s) to given rate(s)
1000 --rateest-bps1 value
1002 --rateest-bps2 value
1004 Compare bytes per second.
1005 --rateest-pps1 value
1007 --rateest-pps2 value
1009 Compare packets per second.
1010 [!] --rateest-lt
1012 Match if rate is less than given rate/estimator.
1013 [!] --rateest-gt
1015 Match if rate is greater than given rate/estimator.
1016 [!] --rateest-eq
1018 Match if rate is equal to given rate/estimator.
1019 Example: This is what can be used to route outgoing data connections
1021 from an FTP server over two lines based on the available bandwidth at
1022 the time the data connection was started:
1023 # Estimate outgoing rates
1025 iptables -t mangle -A POSTROUTING -o eth0 -j RATEEST --rateest-name
1027 eth0 --rateest-interval 250ms --rateest-ewma 0.5s
1028 iptables -t mangle -A POSTROUTING -o ppp0 -j RATEEST --rateest-name
1030 ppp0 --rateest-interval 250ms --rateest-ewma 0.5s
1031 # Mark based on available bandwidth
1033 iptables -t mangle -A balance -m conntrack --ctstate NEW -m helper
1035 --helper ftp -m rateest --rateest-delta --rateest1 eth0 --rateest-bps1
1036 2.5mbit --rateest-gt --rateest2 ppp0 --rateest-bps2 2mbit -j CONNMARK
1037 --set-mark 1
1038 iptables -t mangle -A balance -m conntrack --ctstate NEW -m helper
1040 --helper ftp -m rateest --rateest-delta --rateest1 ppp0 --rateest-bps1
1041 2mbit --rateest-gt --rateest2 eth0 --rateest-bps2 2.5mbit -j CONNMARK
1042 --set-mark 2
1043 iptables -t mangle -A balance -j CONNMARK --restore-mark
1045 realm
1047 This matches the routing realm. Routing realms are used in complex
1048 routing setups involving dynamic routing protocols like BGP.
1049 [!] --realm value[/mask]
1051 Matches a given realm number (and optionally mask). If not a
1052 number, value can be a named realm from /etc/iproute2/rt_realms
1053 (mask can not be used in that case).
1054 recent
1056 Allows you to dynamically create a list of IP addresses and then match
1057 against that list in a few different ways.
1058 For example, you can create a "badguy" list out of people attempting to
1060 connect to port 139 on your firewall and then DROP all future packets
1061 from them without considering them.
1062 --set, --rcheck, --update and --remove are mutually exclusive.
1064 --name name
1066 Specify the list to use for the commands. If no name is given
1067 then DEFAULT will be used.
1068 [!] --set
1070 This will add the source address of the packet to the list. If
1071 the source address is already in the list, this will update the
1072 existing entry. This will always return success (or failure if !
1073 is passed in).
1074 --rsource
1076 Match/save the source address of each packet in the recent list
1077 table. This is the default.
1078 --rdest
1080 Match/save the destination address of each packet in the recent
1081 list table.
1082 [!] --rcheck
1084 Check if the source address of the packet is currently in the
1085 list.
1086 [!] --update
1088 Like --rcheck, except it will update the "last seen" timestamp
1089 if it matches.
1090 [!] --remove
1092 Check if the source address of the packet is currently in the
1093 list and if so that address will be removed from the list and
1094 the rule will return true. If the address is not found, false is
1095 returned.
1096 --seconds seconds
1098 This option must be used in conjunction with one of --rcheck or
1099 --update. When used, this will narrow the match to only happen
1100 when the address is in the list and was seen within the last
1101 given number of seconds.
1102 --hitcount hits
1104 This option must be used in conjunction with one of --rcheck or
1105 --update. When used, this will narrow the match to only happen
1106 when the address is in the list and packets had been received
1107 greater than or equal to the given value. This option may be
1108 used along with --seconds to create an even narrower match
1109 requiring a certain number of hits within a specific time frame.
1110 The maximum value for the hitcount parameter is given by the
1111 "ip_pkt_list_tot" parameter of the xt_recent kernel module.
1112 Exceeding this value on the command line will cause the rule to
1113 be rejected.
1114 --rttl This option may only be used in conjunction with one of --rcheck
1116 or --update. When used, this will narrow the match to only hap‐
1117 pen when the address is in the list and the TTL of the current
1118 packet matches that of the packet which hit the --set rule. This
1119 may be useful if you have problems with people faking their
1120 source address in order to DoS you via this module by disallow‐
1121 ing others access to your site by sending bogus packets to you.
1122 Examples:
1124 iptables -A FORWARD -m recent --name badguy --rcheck --seconds
1126 60 -j DROP
1127 iptables -A FORWARD -p tcp -i eth0 --dport 139 -m recent --name
1129 badguy --set -j DROP
1130 Steve's ipt_recent website (http://snowman.net/projects/ipt_recent/)
1132 also has some examples of usage.
1133 /proc/net/xt_recent/* are the current lists of addresses and informa‐
1135 tion about each entry of each list.
1136 Each file in /proc/net/xt_recent/ can be read from to see the current
1138 list or written two using the following commands to modify the list:
1139 echo +addr >/proc/net/xt_recent/DEFAULT
1141 to add addr to the DEFAULT list
1142 echo -addr >/proc/net/xt_recent/DEFAULT
1144 to remove addr from the DEFAULT list
1145 echo / >/proc/net/xt_recent/DEFAULT
1147 to flush the DEFAULT list (remove all entries).
1148 The module itself accepts parameters, defaults shown:
1150 ip_list_tot=100
1152 Number of addresses remembered per table.
1153 ip_pkt_list_tot=20
1155 Number of packets per address remembered.
1156 ip_list_hash_size=0
1158 Hash table size. 0 means to calculate it based on ip_list_tot,
1159 default: 512.
1160 ip_list_perms=0644
1162 Permissions for /proc/net/xt_recent/* files.
1163 ip_list_uid=0
1165 Numerical UID for ownership of /proc/net/xt_recent/* files.
1166 ip_list_gid=0
1168 Numerical GID for ownership of /proc/net/xt_recent/* files.
1169 sctp
1171 [!] --source-port,--sport port[:port]
1172 [!] --destination-port,--dport port[:port]
1174 [!] --chunk-types {all|any|only} chunktype[:flags] [...]
1176 The flag letter in upper case indicates that the flag is to
1177 match if set, in the lower case indicates to match if unset.
1178 Chunk types: DATA INIT INIT_ACK SACK HEARTBEAT HEARTBEAT_ACK
1180 ABORT SHUTDOWN SHUTDOWN_ACK ERROR COOKIE_ECHO COOKIE_ACK
1181 ECN_ECNE ECN_CWR SHUTDOWN_COMPLETE ASCONF ASCONF_ACK FORWARD_TSN
1182 chunk type available flags
1184 DATA I U B E i u b e
1185 ABORT T t
1186 SHUTDOWN_COMPLETE T t
1187 (lowercase means flag should be "off", uppercase means "on")
1189 Examples:
1191 iptables -A INPUT -p sctp --dport 80 -j DROP
1193 iptables -A INPUT -p sctp --chunk-types any DATA,INIT -j DROP
1195 iptables -A INPUT -p sctp --chunk-types any DATA:Be -j ACCEPT
1197 set
1199 This module matches IP sets which can be defined by ipset(8).
1200 [!] --match-set setname flag[,flag]...
1202 where flags are the comma separated list of src and/or dst spec‐
1203 ifications and there can be no more than six of them. Hence the
1204 command
1205 iptables -A FORWARD -m set --match-set test src,dst
1207 will match packets, for which (if the set type is ipportmap) the
1209 source address and destination port pair can be found in the
1210 specified set. If the set type of the specified set is single
1211 dimension (for example ipmap), then the command will match pack‐
1212 ets for which the source address can be found in the specified
1213 set.
1214 The option --match-set can be replaced by --set if that does not clash
1216 with an option of other extensions.
1217 Use of -m set requires that ipset kernel support is provided. As stan‐
1219 dard kernels do not ship this currently, the ipset or Xtables-addons
1220 package needs to be installed.
1221 socket
1223 This matches if an open socket can be found by doing a socket lookup on
1224 the packet.
1225 state
1227 This module, when combined with connection tracking, allows access to
1228 the connection tracking state for this packet.
1229 [!] --state state
1231 Where state is a comma separated list of the connection states
1232 to match. Possible states are INVALID meaning that the packet
1233 could not be identified for some reason which includes running
1234 out of memory and ICMP errors which don't correspond to any
1235 known connection, ESTABLISHED meaning that the packet is associ‐
1236 ated with a connection which has seen packets in both direc‐
1237 tions, NEW meaning that the packet has started a new connection,
1238 or otherwise associated with a connection which has not seen
1239 packets in both directions, and RELATED meaning that the packet
1240 is starting a new connection, but is associated with an existing
1241 connection, such as an FTP data transfer, or an ICMP error.
1242 UNTRACKED meaning that the packet is not tracked at all, which
1243 happens if you use the NOTRACK target in raw table.
1244 statistic
1246 This module matches packets based on some statistic condition. It sup‐
1247 ports two distinct modes settable with the --mode option.
1248 Supported options:
1250 --mode mode
1252 Set the matching mode of the matching rule, supported modes are
1253 random and nth.
1254 --probability p
1256 Set the probability from 0 to 1 for a packet to be randomly
1257 matched. It works only with the random mode.
1258 --every n
1260 Match one packet every nth packet. It works only with the nth
1261 mode (see also the --packet option).
1262 --packet p
1264 Set the initial counter value (0 <= p <= n-1, default 0) for the
1265 nth mode.
1266 string
1268 This modules matches a given string by using some pattern matching
1269 strategy. It requires a linux kernel >= 2.6.14.
1270 --algo {bm|kmp}
1272 Select the pattern matching strategy. (bm = Boyer-Moore, kmp =
1273 Knuth-Pratt-Morris)
1274 --from offset
1276 Set the offset from which it starts looking for any matching. If
1277 not passed, default is 0.
1278 --to offset
1280 Set the offset up to which should be scanned. That is, byte off‐
1281 set-1 (counting from 0) is the last one that is scanned. If not
1282 passed, default is the packet size.
1283 [!] --string pattern
1285 Matches the given pattern.
1286 [!] --hex-string pattern
1288 Matches the given pattern in hex notation.
1289 tcp
1291 These extensions can be used if `--protocol tcp' is specified. It pro‐
1292 vides the following options:
1293 [!] --source-port,--sport port[:port]
1295 Source port or port range specification. This can either be a
1296 service name or a port number. An inclusive range can also be
1297 specified, using the format first:last. If the first port is
1298 omitted, "0" is assumed; if the last is omitted, "65535" is
1299 assumed. If the first port is greater than the second one they
1300 will be swapped. The flag --sport is a convenient alias for
1301 this option.
1302 [!] --destination-port,--dport port[:port]
1304 Destination port or port range specification. The flag --dport
1305 is a convenient alias for this option.
1306 [!] --tcp-flags mask comp
1308 Match when the TCP flags are as specified. The first argument
1309 mask is the flags which we should examine, written as a comma-
1310 separated list, and the second argument comp is a comma-sepa‐
1311 rated list of flags which must be set. Flags are: SYN ACK FIN
1312 RST URG PSH ALL NONE. Hence the command
1313 iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST SYN
1314 will only match packets with the SYN flag set, and the ACK, FIN
1315 and RST flags unset.
1316 [!] --syn
1318 Only match TCP packets with the SYN bit set and the ACK,RST and
1319 FIN bits cleared. Such packets are used to request TCP connec‐
1320 tion initiation; for example, blocking such packets coming in an
1321 interface will prevent incoming TCP connections, but outgoing
1322 TCP connections will be unaffected. It is equivalent to
1323 --tcp-flags SYN,RST,ACK,FIN SYN. If the "!" flag precedes the
1324 "--syn", the sense of the option is inverted.
1325 [!] --tcp-option number
1327 Match if TCP option set.
1328 tcpmss
1330 This matches the TCP MSS (maximum segment size) field of the TCP
1331 header. You can only use this on TCP SYN or SYN/ACK packets, since the
1332 MSS is only negotiated during the TCP handshake at connection startup
1333 time.
1334 [!] --mss value[:value]
1336 Match a given TCP MSS value or range.
1337 time
1339 This matches if the packet arrival time/date is within a given range.
1340 All options are optional, but are ANDed when specified.
1341 --datestart YYYY[-MM[-DD[Thh[:mm[:ss]]]]]
1343 --datestop YYYY[-MM[-DD[Thh[:mm[:ss]]]]]
1345 Only match during the given time, which must be in ISO 8601 "T"
1347 notation. The possible time range is 1970-01-01T00:00:00 to
1348 2038-01-19T04:17:07.
1349 If --datestart or --datestop are not specified, it will default
1351 to 1970-01-01 and 2038-01-19, respectively.
1352 --timestart hh:mm[:ss]
1354 --timestop hh:mm[:ss]
1356 Only match during the given daytime. The possible time range is
1358 00:00:00 to 23:59:59. Leading zeroes are allowed (e.g. "06:03")
1359 and correctly interpreted as base-10.
1360 [!] --monthdays day[,day...]
1362 Only match on the given days of the month. Possible values are 1
1364 to 31. Note that specifying 31 will of course not match on
1365 months which do not have a 31st day; the same goes for 28- or
1366 29-day February.
1367 [!] --weekdays day[,day...]
1369 Only match on the given weekdays. Possible values are Mon, Tue,
1371 Wed, Thu, Fri, Sat, Sun, or values from 1 to 7, respectively.
1372 You may also use two-character variants (Mo, Tu, etc.).
1373 --utc
1375 Interpret the times given for --datestart, --datestop, --times‐
1377 tart and --timestop to be UTC.
1378 --localtz
1380 Interpret the times given for --datestart, --datestop, --times‐
1382 tart and --timestop to be local kernel time. (Default)
1383 EXAMPLES. To match on weekends, use:
1385 -m time --weekdays Sa,Su
1387 Or, to match (once) on a national holiday block:
1389 -m time --datestart 2007-12-24 --datestop 2007-12-27
1391 Since the stop time is actually inclusive, you would need the following
1393 stop time to not match the first second of the new day:
1394 -m time --datestart 2007-01-01T17:00 --datestop
1396 2007-01-01T23:59:59
1397 During lunch hour:
1399 -m time --timestart 12:30 --timestop 13:30
1401 The fourth Friday in the month:
1403 -m time --weekdays Fr --monthdays 22,23,24,25,26,27,28
1405 (Note that this exploits a certain mathematical property. It is not
1407 possible to say "fourth Thursday OR fourth Friday" in one rule. It is
1408 possible with multiple rules, though.)
1409 tos
1411 This module matches the 8-bit Type of Service field in the IPv4 header
1412 (i.e. including the "Precedence" bits) or the (also 8-bit) Priority
1413 field in the IPv6 header.
1414 [!] --tos value[/mask]
1416 Matches packets with the given TOS mark value. If a mask is
1417 specified, it is logically ANDed with the TOS mark before the
1418 comparison.
1419 [!] --tos symbol
1421 You can specify a symbolic name when using the tos match for
1422 IPv4. The list of recognized TOS names can be obtained by call‐
1423 ing iptables with -m tos -h. Note that this implies a mask of
1424 0x3F, i.e. all but the ECN bits.
1425 ttl
1427 This module matches the time to live field in the IP header.
1428 --ttl-eq ttl
1430 Matches the given TTL value.
1431 --ttl-gt ttl
1433 Matches if TTL is greater than the given TTL value.
1434 --ttl-lt ttl
1436 Matches if TTL is less than the given TTL value.
1437 u32
1439 U32 tests whether quantities of up to 4 bytes extracted from a packet
1440 have specified values. The specification of what to extract is general
1441 enough to find data at given offsets from tcp headers or payloads.
1442 [!] --u32 tests
1444 The argument amounts to a program in a small language described
1445 below.
1446 tests := location "=" value | tests "&&" location "=" value
1448 value := range | value "," range
1450 range := number | number ":" number
1452 a single number, n, is interpreted the same as n:n. n:m is interpreted
1454 as the range of numbers >=n and <=m.
1455 location := number | location operator number
1457 operator := "&" | "<<" | ">>" | "@"
1459 The operators &, <<, >> and && mean the same as in C. The = is really
1461 a set membership operator and the value syntax describes a set. The @
1462 operator is what allows moving to the next header and is described fur‐
1463 ther below.
1464 There are currently some artificial implementation limits on the size
1466 of the tests:
1467 * no more than 10 of "=" (and 9 "&&"s) in the u32 argument
1469 * no more than 10 ranges (and 9 commas) per value
1471 * no more than 10 numbers (and 9 operators) per location
1473 To describe the meaning of location, imagine the following machine that
1475 interprets it. There are three registers:
1476 A is of type char *, initially the address of the IP header
1478 B and C are unsigned 32 bit integers, initially zero
1480 The instructions are:
1482 number B = number;
1484 C = (*(A+B)<<24) + (*(A+B+1)<<16) + (*(A+B+2)<<8) + *(A+B+3)
1486 &number C = C & number
1488 << number C = C << number
1490 >> number C = C >> number
1492 @number A = A + C; then do the instruction number
1494 Any access of memory outside [skb->data,skb->end] causes the match to
1496 fail. Otherwise the result of the computation is the final value of C.
1497 Whitespace is allowed but not required in the tests. However, the char‐
1499 acters that do occur there are likely to require shell quoting, so it
1500 is a good idea to enclose the arguments in quotes.
1501 Example:
1503 match IP packets with total length >= 256
1505 The IP header contains a total length field in bytes 2-3.
1507 --u32 "0 & 0xFFFF = 0x100:0xFFFF"
1509 read bytes 0-3
1511 AND that with 0xFFFF (giving bytes 2-3), and test whether that
1513 is in the range [0x100:0xFFFF]
1514 Example: (more realistic, hence more complicated)
1516 match ICMP packets with icmp type 0
1518 First test that it is an ICMP packet, true iff byte 9 (protocol)
1520 = 1
1521 --u32 "6 & 0xFF = 1 && ...
1523 read bytes 6-9, use & to throw away bytes 6-8 and compare the
1525 result to 1. Next test that it is not a fragment. (If so, it
1526 might be part of such a packet but we cannot always tell.) N.B.:
1527 This test is generally needed if you want to match anything
1528 beyond the IP header. The last 6 bits of byte 6 and all of byte
1529 7 are 0 iff this is a complete packet (not a fragment). Alterna‐
1530 tively, you can allow first fragments by only testing the last 5
1531 bits of byte 6.
1532 ... 4 & 0x3FFF = 0 && ...
1534 Last test: the first byte past the IP header (the type) is 0.
1536 This is where we have to use the @syntax. The length of the IP
1537 header (IHL) in 32 bit words is stored in the right half of byte
1538 0 of the IP header itself.
1539 ... 0 >> 22 & 0x3C @ 0 >> 24 = 0"
1541 The first 0 means read bytes 0-3, >>22 means shift that 22 bits
1543 to the right. Shifting 24 bits would give the first byte, so
1544 only 22 bits is four times that plus a few more bits. &3C then
1545 eliminates the two extra bits on the right and the first four
1546 bits of the first byte. For instance, if IHL=5, then the IP
1547 header is 20 (4 x 5) bytes long. In this case, bytes 0-1 are (in
1548 binary) xxxx0101 yyzzzzzz, >>22 gives the 10 bit value
1549 xxxx0101yy and &3C gives 010100. @ means to use this number as a
1550 new offset into the packet, and read four bytes starting from
1551 there. This is the first 4 bytes of the ICMP payload, of which
1552 byte 0 is the ICMP type. Therefore, we simply shift the value 24
1553 to the right to throw out all but the first byte and compare the
1554 result with 0.
1555 Example:
1557 TCP payload bytes 8-12 is any of 1, 2, 5 or 8
1559 First we test that the packet is a tcp packet (similar to ICMP).
1561 --u32 "6 & 0xFF = 6 && ...
1563 Next, test that it is not a fragment (same as above).
1565 ... 0 >> 22 & 0x3C @ 12 >> 26 & 0x3C @ 8 = 1,2,5,8"
1567 0>>22&3C as above computes the number of bytes in the IP header.
1569 @ makes this the new offset into the packet, which is the start
1570 of the TCP header. The length of the TCP header (again in 32 bit
1571 words) is the left half of byte 12 of the TCP header. The
1572 12>>26&3C computes this length in bytes (similar to the IP
1573 header before). "@" makes this the new offset, which is the
1574 start of the TCP payload. Finally, 8 reads bytes 8-12 of the
1575 payload and = checks whether the result is any of 1, 2, 5 or 8.
1576 udp
1578 These extensions can be used if `--protocol udp' is specified. It pro‐
1579 vides the following options:
1580 [!] --source-port,--sport port[:port]
1582 Source port or port range specification. See the description of
1583 the --source-port option of the TCP extension for details.
1584 [!] --destination-port,--dport port[:port]
1586 Destination port or port range specification. See the descrip‐
1587 tion of the --destination-port option of the TCP extension for
1588 details.
1589 unclean
1591 This module takes no options, but attempts to match packets which seem
1592 malformed or unusual. This is regarded as experimental.
1593
1595 iptables can use extended target modules: the following are included in
1596 the standard distribution.
1597 CLASSIFY
1599 This module allows you to set the skb->priority value (and thus clas‐
1600 sify the packet into a specific CBQ class).
1601 --set-class major:minor
1603 Set the major and minor class value. The values are always
1604 interpreted as hexadecimal even if no 0x prefix is given.
1605 CLUSTERIP
1607 This module allows you to configure a simple cluster of nodes that
1608 share a certain IP and MAC address without an explicit load balancer in
1609 front of them. Connections are statically distributed between the
1610 nodes in this cluster.
1611 --new Create a new ClusterIP. You always have to set this on the
1613 first rule for a given ClusterIP.
1614 --hashmode mode
1616 Specify the hashing mode. Has to be one of sourceip, sour‐
1617 ceip-sourceport, sourceip-sourceport-destport.
1618 --clustermac mac
1620 Specify the ClusterIP MAC address. Has to be a link-layer multi‐
1621 cast address
1622 --total-nodes num
1624 Number of total nodes within this cluster.
1625 --local-node num
1627 Local node number within this cluster.
1628 --hash-init rnd
1630 Specify the random seed used for hash initialization.
1631 CONNMARK
1633 This module sets the netfilter mark value associated with a connection.
1634 The mark is 32 bits wide.
1635 --set-xmark value[/mask]
1637 Zero out the bits given by mask and XOR value into the ctmark.
1638 --save-mark [--nfmask nfmask] [--ctmask ctmask]
1640 Copy the packet mark (nfmark) to the connection mark (ctmark)
1641 using the given masks. The new nfmark value is determined as
1642 follows:
1643 ctmark = (ctmark & ~ctmask) ^ (nfmark & nfmask)
1645 i.e. ctmask defines what bits to clear and nfmask what bits of
1647 the nfmark to XOR into the ctmark. ctmask and nfmask default to
1648 0xFFFFFFFF.
1649 --restore-mark [--nfmask nfmask] [--ctmask ctmask]
1651 Copy the connection mark (ctmark) to the packet mark (nfmark)
1652 using the given masks. The new ctmark value is determined as
1653 follows:
1654 nfmark = (nfmark & ~nfmask) ^ (ctmark & ctmask);
1656 i.e. nfmask defines what bits to clear and ctmask what bits of
1658 the ctmark to XOR into the nfmark. ctmask and nfmask default to
1659 0xFFFFFFFF.
1660 --restore-mark is only valid in the mangle table.
1662 The following mnemonics are available for --set-xmark:
1664 --and-mark bits
1666 Binary AND the ctmark with bits. (Mnemonic for --set-xmark
1667 0/invbits, where invbits is the binary negation of bits.)
1668 --or-mark bits
1670 Binary OR the ctmark with bits. (Mnemonic for --set-xmark
1671 bits/bits.)
1672 --xor-mark bits
1674 Binary XOR the ctmark with bits. (Mnemonic for --set-xmark
1675 bits/0.)
1676 --set-mark value[/mask]
1678 Set the connection mark. If a mask is specified then only those
1679 bits set in the mask are modified.
1680 --save-mark [--mask mask]
1682 Copy the nfmark to the ctmark. If a mask is specified, only
1683 those bits are copied.
1684 --restore-mark [--mask mask]
1686 Copy the ctmark to the nfmark. If a mask is specified, only
1687 those bits are copied. This is only valid in the mangle table.
1688 CONNSECMARK
1690 This module copies security markings from packets to connections (if
1691 unlabeled), and from connections back to packets (also only if unla‐
1692 beled). Typically used in conjunction with SECMARK, it is only valid
1693 in the mangle table.
1694 --save If the packet has a security marking, copy it to the connection
1696 if the connection is not marked.
1697 --restore
1699 If the packet does not have a security marking, and the connec‐
1700 tion does, copy the security marking from the connection to the
1701 packet.
1702 CT
1705 The CT target allows to set parameters for a packet or its associated
1706 connection. The target attaches a "template" connection tracking entry
1707 to the packet, which is then used by the conntrack core when initializ‐
1708 ing a new ct entry. This target is thus only valid in the "raw" table.
1709 --notrack
1711 Disables connection tracking for this packet.
1712 --helper name
1714 Use the helper identified by name for the connection. This is
1715 more flexible than loading the conntrack helper modules with
1716 preset ports.
1717 --ctevents event[,...]
1719 Only generate the specified conntrack events for this connec‐
1720 tion. Possible event types are: new, related, destroy, reply,
1721 assured, protoinfo, helper, mark (this refers to the ctmark, not
1722 nfmark), natseqinfo, secmark (ctsecmark).
1723 --expevents event[,...]
1725 Only generate the specified expectation events for this connec‐
1726 tion. Possible event types are: new.
1727 --zone id
1729 Assign this packet to zone id and only have lookups done in that
1730 zone. By default, packets have zone 0.
1731 DNAT
1733 This target is only valid in the nat table, in the PREROUTING and OUT‐
1734 PUT chains, and user-defined chains which are only called from those
1735 chains. It specifies that the destination address of the packet should
1736 be modified (and all future packets in this connection will also be
1737 mangled), and rules should cease being examined. It takes one type of
1738 option:
1739 --to-destination [ipaddr][-ipaddr][:port[-port]]
1741 which can specify a single new destination IP address, an inclu‐
1742 sive range of IP addresses, and optionally, a port range (which
1743 is only valid if the rule also specifies -p tcp or -p udp). If
1744 no port range is specified, then the destination port will never
1745 be modified. If no IP address is specified then only the desti‐
1746 nation port will be modified.
1747 In Kernels up to 2.6.10 you can add several --to-destination
1749 options. For those kernels, if you specify more than one desti‐
1750 nation address, either via an address range or multiple
1751 --to-destination options, a simple round-robin (one after
1752 another in cycle) load balancing takes place between these
1753 addresses. Later Kernels (>= 2.6.11-rc1) don't have the ability
1754 to NAT to multiple ranges anymore.
1755 --random
1757 If option --random is used then port mapping will be randomized
1758 (kernel >= 2.6.22).
1759 --persistent
1761 Gives a client the same source-/destination-address for each
1762 connection. This supersedes the SAME target. Support for per‐
1763 sistent mappings is available from 2.6.29-rc2.
1764 DSCP
1766 This target allows to alter the value of the DSCP bits within the TOS
1767 header of the IPv4 packet. As this manipulates a packet, it can only
1768 be used in the mangle table.
1769 --set-dscp value
1771 Set the DSCP field to a numerical value (can be decimal or hex)
1772 --set-dscp-class class
1774 Set the DSCP field to a DiffServ class.
1775 ECN
1777 This target allows to selectively work around known ECN blackholes. It
1778 can only be used in the mangle table.
1779 --ecn-tcp-remove
1781 Remove all ECN bits from the TCP header. Of course, it can only
1782 be used in conjunction with -p tcp.
1783 LOG
1785 Turn on kernel logging of matching packets. When this option is set
1786 for a rule, the Linux kernel will print some information on all match‐
1787 ing packets (like most IP header fields) via the kernel log (where it
1788 can be read with dmesg or syslogd(8)). This is a "non-terminating tar‐
1789 get", i.e. rule traversal continues at the next rule. So if you want
1790 to LOG the packets you refuse, use two separate rules with the same
1791 matching criteria, first using target LOG then DROP (or REJECT).
1792 --log-level level
1794 Level of logging (numeric or see syslog.conf(5)).
1795 --log-prefix prefix
1797 Prefix log messages with the specified prefix; up to 29 letters
1798 long, and useful for distinguishing messages in the logs.
1799 --log-tcp-sequence
1801 Log TCP sequence numbers. This is a security risk if the log is
1802 readable by users.
1803 --log-tcp-options
1805 Log options from the TCP packet header.
1806 --log-ip-options
1808 Log options from the IP packet header.
1809 --log-uid
1811 Log the userid of the process which generated the packet.
1812 MARK
1814 This target is used to set the Netfilter mark value associated with the
1815 packet. It can, for example, be used in conjunction with routing based
1816 on fwmark (needs iproute2). If you plan on doing so, note that the mark
1817 needs to be set in the PREROUTING chain of the mangle table to affect
1818 routing. The mark field is 32 bits wide.
1819 --set-xmark value[/mask]
1821 Zeroes out the bits given by mask and XORs value into the packet
1822 mark ("nfmark"). If mask is omitted, 0xFFFFFFFF is assumed.
1823 --set-mark value[/mask]
1825 Zeroes out the bits given by mask and ORs value into the packet
1826 mark. If mask is omitted, 0xFFFFFFFF is assumed.
1827 The following mnemonics are available:
1829 --and-mark bits
1831 Binary AND the nfmark with bits. (Mnemonic for --set-xmark
1832 0/invbits, where invbits is the binary negation of bits.)
1833 --or-mark bits
1835 Binary OR the nfmark with bits. (Mnemonic for --set-xmark
1836 bits/bits.)
1837 --xor-mark bits
1839 Binary XOR the nfmark with bits. (Mnemonic for --set-xmark
1840 bits/0.)
1841 MASQUERADE
1843 This target is only valid in the nat table, in the POSTROUTING chain.
1844 It should only be used with dynamically assigned IP (dialup) connec‐
1845 tions: if you have a static IP address, you should use the SNAT target.
1846 Masquerading is equivalent to specifying a mapping to the IP address of
1847 the interface the packet is going out, but also has the effect that
1848 connections are forgotten when the interface goes down. This is the
1849 correct behavior when the next dialup is unlikely to have the same
1850 interface address (and hence any established connections are lost any‐
1851 way). It takes one option:
1852 --to-ports port[-port]
1854 This specifies a range of source ports to use, overriding the
1855 default SNAT source port-selection heuristics (see above). This
1856 is only valid if the rule also specifies -p tcp or -p udp.
1857 --random
1859 Randomize source port mapping If option --random is used then
1860 port mapping will be randomized (kernel >= 2.6.21).
1861 MIRROR
1863 This is an experimental demonstration target which inverts the source
1864 and destination fields in the IP header and retransmits the packet. It
1865 is only valid in the INPUT, FORWARD and PREROUTING chains, and user-
1866 defined chains which are only called from those chains. Note that the
1867 outgoing packets are NOT seen by any packet filtering chains, connec‐
1868 tion tracking or NAT, to avoid loops and other problems.
1869 NETMAP
1871 This target allows you to statically map a whole network of addresses
1872 onto another network of addresses. It can only be used from rules in
1873 the nat table.
1874 --to address[/mask]
1876 Network address to map to. The resulting address will be con‐
1877 structed in the following way: All 'one' bits in the mask are
1878 filled in from the new `address'. All bits that are zero in the
1879 mask are filled in from the original address.
1880 NFLOG
1882 This target provides logging of matching packets. When this target is
1883 set for a rule, the Linux kernel will pass the packet to the loaded
1884 logging backend to log the packet. This is usually used in combination
1885 with nfnetlink_log as logging backend, which will multicast the packet
1886 through a netlink socket to the specified multicast group. One or more
1887 userspace processes may subscribe to the group to receive the packets.
1888 Like LOG, this is a non-terminating target, i.e. rule traversal contin‐
1889 ues at the next rule.
1890 --nflog-group nlgroup
1892 The netlink group (1 - 2^32-1) to which packets are (only appli‐
1893 cable for nfnetlink_log). The default value is 0.
1894 --nflog-prefix prefix
1896 A prefix string to include in the log message, up to 64 charac‐
1897 ters long, useful for distinguishing messages in the logs.
1898 --nflog-range size
1900 The number of bytes to be copied to userspace (only applicable
1901 for nfnetlink_log). nfnetlink_log instances may specify their
1902 own range, this option overrides it.
1903 --nflog-threshold size
1905 Number of packets to queue inside the kernel before sending them
1906 to userspace (only applicable for nfnetlink_log). Higher values
1907 result in less overhead per packet, but increase delay until the
1908 packets reach userspace. The default value is 1.
1909 NFQUEUE
1911 This target is an extension of the QUEUE target. As opposed to QUEUE,
1912 it allows you to put a packet into any specific queue, identified by
1913 its 16-bit queue number. It can only be used with Kernel versions
1914 2.6.14 or later, since it requires the nfnetlink_queue kernel support.
1915 The queue-balance option was added in Linux 2.6.31.
1916 --queue-num value
1918 This specifies the QUEUE number to use. Valid queue numbers are
1919 0 to 65535. The default value is 0.
1920 --queue-balance value:value
1922 This specifies a range of queues to use. Packets are then bal‐
1923 anced across the given queues. This is useful for multicore
1924 systems: start multiple instances of the userspace program on
1925 queues x, x+1, .. x+n and use "--queue-balance x:x+n". Packets
1926 belonging to the same connection are put into the same nfqueue.
1927 NOTRACK
1929 This target disables connection tracking for all packets matching that
1930 rule.
1931 It can only be used in the raw table.
1933 RATEEST
1935 The RATEEST target collects statistics, performs rate estimation calcu‐
1936 lation and saves the results for later evaluation using the rateest
1937 match.
1938 --rateest-name name
1940 Count matched packets into the pool referred to by name, which
1941 is freely choosable.
1942 --rateest-interval amount{s|ms|us}
1944 Rate measurement interval, in seconds, milliseconds or microsec‐
1945 onds.
1946 --rateest-ewmalog value
1948 Rate measurement averaging time constant.
1949 REDIRECT
1951 This target is only valid in the nat table, in the PREROUTING and OUT‐
1952 PUT chains, and user-defined chains which are only called from those
1953 chains. It redirects the packet to the machine itself by changing the
1954 destination IP to the primary address of the incoming interface
1955 (locally-generated packets are mapped to the 127.0.0.1 address).
1956 --to-ports port[-port]
1958 This specifies a destination port or range of ports to use:
1959 without this, the destination port is never altered. This is
1960 only valid if the rule also specifies -p tcp or -p udp.
1961 --random
1963 If option --random is used then port mapping will be randomized
1964 (kernel >= 2.6.22).
1965 REJECT
1967 This is used to send back an error packet in response to the matched
1968 packet: otherwise it is equivalent to DROP so it is a terminating TAR‐
1969 GET, ending rule traversal. This target is only valid in the INPUT,
1970 FORWARD and OUTPUT chains, and user-defined chains which are only
1971 called from those chains. The following option controls the nature of
1972 the error packet returned:
1973 --reject-with type
1975 The type given can be icmp-net-unreachable, icmp-host-unreach‐
1976 able, icmp-port-unreachable, icmp-proto-unreachable,
1977 icmp-net-prohibited, icmp-host-prohibited or icmp-admin-prohib‐
1978 ited (*) which return the appropriate ICMP error message
1979 (port-unreachable is the default). The option tcp-reset can be
1980 used on rules which only match the TCP protocol: this causes a
1981 TCP RST packet to be sent back. This is mainly useful for
1982 blocking ident (113/tcp) probes which frequently occur when
1983 sending mail to broken mail hosts (which won't accept your mail
1984 otherwise).
1985 (*) Using icmp-admin-prohibited with kernels that do not support it
1987 will result in a plain DROP instead of REJECT
1988 SAME
1990 Similar to SNAT/DNAT depending on chain: it takes a range of addresses
1991 (`--to 1.2.3.4-1.2.3.7') and gives a client the same source-/destina‐
1992 tion-address for each connection.
1993 N.B.: The DNAT target's --persistent option replaced the SAME target.
1995 --to ipaddr[-ipaddr]
1997 Addresses to map source to. May be specified more than once for
1998 multiple ranges.
1999 --nodst
2001 Don't use the destination-ip in the calculations when selecting
2002 the new source-ip
2003 --random
2005 Port mapping will be forcibly randomized to avoid attacks based
2006 on port prediction (kernel >= 2.6.21).
2007 SECMARK
2009 This is used to set the security mark value associated with the packet
2010 for use by security subsystems such as SELinux. It is only valid in
2011 the mangle table. The mark is 32 bits wide.
2012 --selctx security_context
2014 SET
2016 This modules adds and/or deletes entries from IP sets which can be
2017 defined by ipset(8).
2018 --add-set setname flag[,flag...]
2020 add the address(es)/port(s) of the packet to the sets
2021 --del-set setname flag[,flag...]
2023 delete the address(es)/port(s) of the packet from the sets
2024 where flags are src and/or dst specifications and there can be
2026 no more than six of them.
2027 Use of -j SET requires that ipset kernel support is provided. As stan‐
2029 dard kernels do not ship this currently, the ipset or Xtables-addons
2030 package needs to be installed.
2031 SNAT
2033 This target is only valid in the nat table, in the POSTROUTING chain.
2034 It specifies that the source address of the packet should be modified
2035 (and all future packets in this connection will also be mangled), and
2036 rules should cease being examined. It takes one type of option:
2037 --to-source ipaddr[-ipaddr][:port[-port]]
2039 which can specify a single new source IP address, an inclusive
2040 range of IP addresses, and optionally, a port range (which is
2041 only valid if the rule also specifies -p tcp or -p udp). If no
2042 port range is specified, then source ports below 512 will be
2043 mapped to other ports below 512: those between 512 and 1023
2044 inclusive will be mapped to ports below 1024, and other ports
2045 will be mapped to 1024 or above. Where possible, no port alter‐
2046 ation will
2047 In Kernels up to 2.6.10, you can add several --to-source
2049 options. For those kernels, if you specify more than one source
2050 address, either via an address range or multiple --to-source
2051 options, a simple round-robin (one after another in cycle) takes
2052 place between these addresses. Later Kernels (>= 2.6.11-rc1)
2053 don't have the ability to NAT to multiple ranges anymore.
2054 --random
2056 If option --random is used then port mapping will be randomized
2057 (kernel >= 2.6.21).
2058 --persistent
2060 Gives a client the same source-/destination-address for each
2061 connection. This supersedes the SAME target. Support for per‐
2062 sistent mappings is available from 2.6.29-rc2.
2063 TCPMSS
2065 This target allows to alter the MSS value of TCP SYN packets, to con‐
2066 trol the maximum size for that connection (usually limiting it to your
2067 outgoing interface's MTU minus 40 for IPv4 or 60 for IPv6, respec‐
2068 tively). Of course, it can only be used in conjunction with -p tcp.
2069 This target is used to overcome criminally braindead ISPs or servers
2071 which block "ICMP Fragmentation Needed" or "ICMPv6 Packet Too Big"
2072 packets. The symptoms of this problem are that everything works fine
2073 from your Linux firewall/router, but machines behind it can never
2074 exchange large packets:
2075 1) Web browsers connect, then hang with no data received.
2076 2) Small mail works fine, but large emails hang.
2077 3) ssh works fine, but scp hangs after initial handshaking.
2078 Workaround: activate this option and add a rule to your firewall con‐
2079 figuration like:
2080 iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN
2082 -j TCPMSS --clamp-mss-to-pmtu
2083 --set-mss value
2085 Explicitly sets MSS option to specified value. If the MSS of the
2086 packet is already lower than value, it will not be increased
2087 (from Linux 2.6.25 onwards) to avoid more problems with hosts
2088 relying on a proper MSS.
2089 --clamp-mss-to-pmtu
2091 Automatically clamp MSS value to (path_MTU - 40 for IPv4; -60
2092 for IPv6). This may not function as desired where asymmetric
2093 routes with differing path MTU exist — the kernel uses the path
2094 MTU which it would use to send packets from itself to the source
2095 and destination IP addresses. Prior to Linux 2.6.25, only the
2096 path MTU to the destination IP address was considered by this
2097 option; subsequent kernels also consider the path MTU to the
2098 source IP address.
2099 These options are mutually exclusive.
2101 TCPOPTSTRIP
2103 This target will strip TCP options off a TCP packet. (It will actually
2104 replace them by NO-OPs.) As such, you will need to add the -p tcp
2105 parameters.
2106 --strip-options option[,option...]
2108 Strip the given option(s). The options may be specified by TCP
2109 option number or by symbolic name. The list of recognized
2110 options can be obtained by calling iptables with -j TCPOPTSTRIP
2111 -h.
2112 TEE
2114 The TEE target will clone a packet and redirect this clone to another
2115 machine on the local network segment. In other words, the nexthop must
2116 be the target, or you will have to configure the nexthop to forward it
2117 further if so desired.
2118 --gateway ipaddr
2120 Send the cloned packet to the host reachable at the given IP
2121 address. Use of 0.0.0.0 (for IPv4 packets) or :: (IPv6) is
2122 invalid.
2123 To forward all incoming traffic on eth0 to an Network Layer logging
2125 box:
2126 -t mangle -A PREROUTING -i eth0 -j TEE --gateway 2001:db8::1
2128 TOS
2130 This module sets the Type of Service field in the IPv4 header (includ‐
2131 ing the "precedence" bits) or the Priority field in the IPv6 header.
2132 Note that TOS shares the same bits as DSCP and ECN. The TOS target is
2133 only valid in the mangle table.
2134 --set-tos value[/mask]
2136 Zeroes out the bits given by mask and XORs value into the
2137 TOS/Priority field. If mask is omitted, 0xFF is assumed.
2138 --set-tos symbol
2140 You can specify a symbolic name when using the TOS target for
2141 IPv4. It implies a mask of 0xFF. The list of recognized TOS
2142 names can be obtained by calling iptables with -j TOS -h.
2143 The following mnemonics are available:
2145 --and-tos bits
2147 Binary AND the TOS value with bits. (Mnemonic for --set-tos
2148 0/invbits, where invbits is the binary negation of bits.)
2149 --or-tos bits
2151 Binary OR the TOS value with bits. (Mnemonic for --set-tos
2152 bits/bits.)
2153 --xor-tos bits
2155 Binary XOR the TOS value with bits. (Mnemonic for --set-tos
2156 bits/0.)
2157 TPROXY
2159 This target is only valid in the mangle table, in the PREROUTING chain
2160 and user-defined chains which are only called from this chain. It redi‐
2161 rects the packet to a local socket without changing the packet header
2162 in any way. It can also change the mark value which can then be used in
2163 advanced routing rules. It takes three options:
2164 --on-port port
2166 This specifies a destination port to use. It is a required
2167 option, 0 means the new destination port is the same as the
2168 original. This is only valid if the rule also specifies -p tcp
2169 or -p udp.
2170 --on-ip address
2172 This specifies a destination address to use. By default the
2173 address is the IP address of the incoming interface. This is
2174 only valid if the rule also specifies -p tcp or -p udp.
2175 --tproxy-mark value[/mask]
2177 Marks packets with the given value/mask. The fwmark value set
2178 here can be used by advanced routing. (Required for transparent
2179 proxying to work: otherwise these packets will get forwarded,
2180 which is probably not what you want.)
2181 TRACE
2183 This target marks packes so that the kernel will log every rule which
2184 match the packets as those traverse the tables, chains, rules. (The
2185 ipt_LOG or ip6t_LOG module is required for the logging.) The packets
2186 are logged with the string prefix: "TRACE: tablename:chain‐
2187 name:type:rulenum " where type can be "rule" for plain rule, "return"
2188 for implicit rule at the end of a user defined chain and "policy" for
2189 the policy of the built in chains.
2190 It can only be used in the raw table.
2191 TTL
2193 This is used to modify the IPv4 TTL header field. The TTL field deter‐
2194 mines how many hops (routers) a packet can traverse until it's time to
2195 live is exceeded.
2196 Setting or incrementing the TTL field can potentially be very danger‐
2198 ous, so it should be avoided at any cost.
2199 Don't ever set or increment the value on packets that leave your local
2201 network! mangle table.
2202 --ttl-set value
2204 Set the TTL value to `value'.
2205 --ttl-dec value
2207 Decrement the TTL value `value' times.
2208 --ttl-inc value
2210 Increment the TTL value `value' times.
2211 ULOG
2213 This target provides userspace logging of matching packets. When this
2214 target is set for a rule, the Linux kernel will multicast this packet
2215 through a netlink socket. One or more userspace processes may then sub‐
2216 scribe to various multicast groups and receive the packets. Like LOG,
2217 this is a "non-terminating target", i.e. rule traversal continues at
2218 the next rule.
2219 --ulog-nlgroup nlgroup
2221 This specifies the netlink group (1-32) to which the packet is
2222 sent. Default value is 1.
2223 --ulog-prefix prefix
2225 Prefix log messages with the specified prefix; up to 32 charac‐
2226 ters long, and useful for distinguishing messages in the logs.
2227 --ulog-cprange size
2229 Number of bytes to be copied to userspace. A value of 0 always
2230 copies the entire packet, regardless of its size. Default is 0.
2231 --ulog-qthreshold size
2233 Number of packet to queue inside kernel. Setting this value to,
2234 e.g. 10 accumulates ten packets inside the kernel and transmits
2235 them as one netlink multipart message to userspace. Default is
2236 1 (for backwards compatibility).
2237
2239 Various error messages are printed to standard error. The exit code is
2240 0 for correct functioning. Errors which appear to be caused by invalid
2241 or abused command line parameters cause an exit code of 2, and other
2242 errors cause an exit code of 1.
2243
2245 Bugs? What's this? ;-) Well, you might want to have a look at
2246 http://bugzilla.netfilter.org/
2247
2249 This iptables is very similar to ipchains by Rusty Russell. The main
2250 difference is that the chains INPUT and OUTPUT are only traversed for
2251 packets coming into the local host and originating from the local host
2252 respectively. Hence every packet only passes through one of the three
2253 chains (except loopback traffic, which involves both INPUT and OUTPUT
2254 chains); previously a forwarded packet would pass through all three.
2255 The other main difference is that -i refers to the input interface; -o
2257 refers to the output interface, and both are available for packets
2258 entering the FORWARD chain.
2259 The various forms of NAT have been separated out; iptables is a pure
2261 packet filter when using the default `filter' table, with optional
2262 extension modules. This should simplify much of the previous confusion
2263 over the combination of IP masquerading and packet filtering seen pre‐
2264 viously. So the following options are handled differently:
2265 -j MASQ
2266 -M -S
2267 -M -L
2268 There are several other changes in iptables.
2269
2271 iptables-save(8), iptables-restore(8), ip6tables(8), ip6tables-save(8),
2272 ip6tables-restore(8), libipq(3).
2273 The packet-filtering-HOWTO details iptables usage for packet filtering,
2275 the NAT-HOWTO details NAT, the netfilter-extensions-HOWTO details the
2276 extensions that are not in the standard distribution, and the netfil‐
2277 ter-hacking-HOWTO details the netfilter internals.
2278 See http://www.netfilter.org/.
2279
2281 Rusty Russell originally wrote iptables, in early consultation with
2282 Michael Neuling.
2283 Marc Boucher made Rusty abandon ipnatctl by lobbying for a generic
2285 packet selection framework in iptables, then wrote the mangle table,
2286 the owner match, the mark stuff, and ran around doing cool stuff every‐
2287 where.
2288 James Morris wrote the TOS target, and tos match.
2290 Jozsef Kadlecsik wrote the REJECT target.
2292 Harald Welte wrote the ULOG and NFQUEUE target, the new libiptc, as
2294 well as the TTL, DSCP, ECN matches and targets.
2295 The Netfilter Core Team is: Marc Boucher, Martin Josefsson, Yasuyuki
2297 Kozakai, Jozsef Kadlecsik, Patrick McHardy, James Morris, Pablo Neira
2298 Ayuso, Harald Welte and Rusty Russell.
2299 Man page originally written by Herve Eychenne <rv@wallfire.org>.
2301iptables 1.4.9 IPTABLES(8)