Content-type: text/html
`
`IPTABLES
`
`Section: (8)
`Updated: Mar 09, 2002
`Index
`
`NAME
`
`iptables - administration tool for IPv4 packet filtering and NAT
`SYNOPSIS
`iptables [-t table] -[AD] chain rule-specification [options]
`iptables [-t table] -I chain [rulenum] rule-specification [options]
`iptables [-t table] -R chain rulenum rule-specification [options]
`iptables [-t table] -D chain rulenum [options]
`iptables [-t table] -[LFZ] [chain] [options]
`iptables [-t table] -N chain
`iptables [-t table] -X [chain]
`iptables [-t table] -P chain target [options]
`iptables [-t table] -E old-chain-name new-chain-name
`DESCRIPTION
`Iptables is used to set up, maintain, and inspect the tables of IP packet filter rules in the Linux kernel.
`Several different tables may be defined. Each table contains a number of built-in chains and may also
`contain user-defined chains.
`
`Each chain is a list of rules which can match a set of packets. Each rule specifies what to do with a
`packet that matches. This is called a `target', which may be a jump to a user-defined chain in the same
`table.
`
`TARGETS
`
`A firewall rule specifies criteria for a packet, and a target. If the packet does not match, the next rule
`in the chain is the examined; if it does match, then the next rule is specified by the value of the target,
`which can be the name of a user-defined chain or one of the special values ACCEPT, DROP,
`QUEUE, or RETURN.
`
`MCM Ex. 2007, pg. 1
`
`

`

`ACCEPT means to let the packet through. DROP means to drop the packet on the floor. QUEUE
`means to pass the packet to userspace (if supported by the kernel). RETURN means stop traversing
`this chain and resume at the next rule in the previous (calling) chain. If the end of a built-in chain is
`reached or a rule in a built-in chain with target RETURN is matched, the target specified by the chain
`policy determines the fate of the packet.
`TABLES
`
`There are currently three independent tables (which tables are present at any time depends on the
`kernel configuration options and which modules are present).
`
`-t, --table table
`This option specifies the packet matching table which the command should operate on. If the
`kernel is configured with automatic module loading, an attempt will be made to load the
`appropriate module for that table if it is not already there.
`
`The tables are as follows:
`
`filter:
`This is the default table (if no -t option is passed). It contains the built-in chains
`INPUT (for packets coming into the box itself), FORWARD (for packets being
`routed through the box), and OUTPUT (for locally-generated packets).
`
`nat:
`
`This table is consulted when a packet that creates a new connection is encountered.
`It consists of three built-ins: PREROUTING (for altering packets as soon as they
`come in), OUTPUT (for altering locally-generated packets before routing), and
`POSTROUTING (for altering packets as they are about to go out).
`mangle:
`This table is used for specialized packet alteration. Until kernel 2.4.17 it had two
`built-in chains: PREROUTING (for altering incoming packets before routing) and
`OUTPUT (for altering locally-generated packets before routing). Since kernel
`2.4.18, three other built-in chains are also supported: INPUT (for packets coming
`into the box itself), FORWARD (for altering packets being routed through the
`box), and POSTROUTING (for altering packets as they are about to go out).
`
`raw:
`
`This table is used mainly for configuring exemptions from connection tracking in
`combination with the NOTRACK target. It registers at the netfilter hooks with
`higher priority and is thus called before ip_conntrack, or any other IP tables. It
`provides the following built-in chains: PREROUTING (for packets arriving via
`any network interface) OUTPUT (for packets generated by local processes)
`
`OPTIONS
`The options that are recognized by iptables can be divided into several different groups.
`
`MCM Ex. 2007, pg. 2
`
`

`

`COMMANDS
`
`These options specify the specific action to perform. Only one of them can be specified on the
`command line unless otherwise specified below. For all the long versions of the command and option
`names, you need to use only enough letters to ensure that iptables can differentiate it from all other
`options.
`
`-A, --append chain rule-specification
`Append one or more rules to the end of the selected chain. When the source and/or destination
`names resolve to more than one address, a rule will be added for each possible address
`combination.
`-D, --delete chain rule-specification
`-D, --delete chain rulenum
`Delete one or more rules from the selected chain. There are two versions of this command: the
`rule can be specified as a number in the chain (starting at 1 for the first rule) or a rule to match.
`-I, --insert chain [rulenum] rule-specification
`Insert one or more rules in the selected chain as the given rule number. So, if the rule number is
`1, the rule or rules are inserted at the head of the chain. This is also the default if no rule
`number is specified.
`-R, --replace chain rulenum rule-specification
`Replace a rule in the selected chain. If the source and/or destination names resolve to multiple
`addresses, the command will fail. Rules are numbered starting at 1.
`-L, --list [chain]
`List all rules in the selected chain. If no chain is selected, all chains are listed. As every other
`iptables command, it applies to the specified table (filter is the default), so NAT rules get listed
`by
`
` iptables -t nat -n -L
`Please note that it is often used with the -n option, in order to avoid long reverse DNS lookups.
`It is legal to specify the -Z (zero) option as well, in which case the chain(s) will be atomically
`listed and zeroed. The exact output is affected by the other arguments given. The exact rules are
`suppressed until you use
`
` iptables -L -v
`-F, --flush [chain]
`Flush the selected chain (all the chains in the table if none is given). This is equivalent to
`deleting all the rules one by one.
`-Z, --zero [chain]
`Zero the packet and byte counters in all chains. It is legal to specify the -L, --list (list) option as
`well, to see the counters immediately before they are cleared. (See above.)
`-N, --new-chain chain
`Create a new user-defined chain by the given name. There must be no target of that name
`already.
`-X, --delete-chain [chain]
`Delete the optional user-defined chain specified. There must be no references to the chain. If
`there are, you must delete or replace the referring rules before the chain can be deleted. If no
`argument is given, it will attempt to delete every non-builtin chain in the table.
`-P, --policy chain target
`
`MCM Ex. 2007, pg. 3
`
`

`

`Set the policy for the chain to the given target. See the section TARGETS for the legal targets.
`Only built-in (non-user-defined) chains can have policies, and neither built-in nor user-defined
`chains can be policy targets.
`-E, --rename-chain old-chain new-chain
`Rename the user specified chain to the user supplied name. This is cosmetic, and has no effect
`on the structure of the table.
`
`-h
`
`Help. Give a (currently very brief) description of the command syntax.
`
`PARAMETERS
`
`The following parameters make up a rule specification (as used in the add, delete, insert, replace and
`append commands).
`
`-p, --protocol [!] protocol
`The protocol of the rule or of the packet to check. The specified protocol can be one of tcp, udp,
`icmp, or all, or it can be a numeric value, representing one of these protocols or a different one.
`A protocol name from /etc/protocols is also allowed. A "!" argument before the protocol inverts
`the test. The number zero is equivalent to all. Protocol all will match with all protocols and is
`taken as default when this option is omitted.
`-s, --source [!] address[/mask]
`Source specification. Address can be either a network name, a hostname (please note that
`specifying any name to be resolved with a remote query such as DNS is a really bad idea), a
`network IP address (with /mask), or a plain IP address. The mask can be either a network mask
`or a plain number, specifying the number of 1's at the left side of the network mask. Thus, a
`mask of 24 is equivalent to 255.255.255.0. A "!" argument before the address specification
`inverts the sense of the address. The flag --src is an alias for this option.
`-d, --destination [!] address[/mask]
`Destination specification. See the description of the -s (source) flag for a detailed description of
`the syntax. The flag --dst is an alias for this option.
`-j, --jump target
`This specifies the target of the rule; i.e., what to do if the packet matches it. The target can be a
`user-defined chain (other than the one this rule is in), one of the special builtin targets which
`decide the fate of the packet immediately, or an extension (see EXTENSIONS below). If this
`option is omitted in a rule, then matching the rule will have no effect on the packet's fate, but
`the counters on the rule will be incremented.
`-i, --in-interface [!] name
`Name of an interface via which a packet was received (only for packets entering the INPUT,
`FORWARD and PREROUTING chains). When the "!" argument is used before the interface
`name, the sense is inverted. If the interface name ends in a "+", then any interface which begins
`with this name will match. If this option is omitted, any interface name will match.
`-o, --out-interface [!] name
`Name of an interface via which a packet is going to be sent (for packets entering the
`FORWARD, OUTPUT and POSTROUTING chains). When the "!" argument is used before
`the interface name, the sense is inverted. If the interface name ends in a "+", then any interface
`which begins with this name will match. If this option is omitted, any interface name will
`match.
`
`MCM Ex. 2007, pg. 4
`
`

`

`[!] -f, --fragment
`This means that the rule only refers to second and further fragments of fragmented packets.
`Since there is no way to tell the source or destination ports of such a packet (or ICMP type),
`such a packet will not match any rules which specify them. When the "!" argument precedes the
`"-f" flag, the rule will only match head fragments, or unfragmented packets.
`-c, --set-counters PKTS BYTES
`This enables the administrator to initialize the packet and byte counters of a rule (during
`INSERT, APPEND, REPLACE operations).
`
`OTHER OPTIONS
`
`The following additional options can be specified:
`
`-v, --verbose
`Verbose output. This option makes the list command show the interface name, the rule options
`(if any), and the TOS masks. The packet and byte counters are also listed, with the suffix 'K',
`'M' or 'G' for 1000, 1,000,000 and 1,000,000,000 multipliers respectively (but see the -x flag to
`change this). For appending, insertion, deletion and replacement, this causes detailed
`information on the rule or rules to be printed.
`-n, --numeric
`Numeric output. IP addresses and port numbers will be printed in numeric format. By default,
`the program will try to display them as host names, network names, or services (whenever
`applicable).
`-x, --exact
`Expand numbers. Display the exact value of the packet and byte counters, instead of only the
`rounded number in K's (multiples of 1000) M's (multiples of 1000K) or G's (multiples of
`1000M). This option is only relevant for the -L command.
`--line-numbers
`When listing rules, add line numbers to the beginning of each rule, corresponding to that rule's
`position in the chain.
`--modprobe=command
`When adding or inserting rules into a chain, use command to load any necessary modules
`(targets, match extensions, etc).
`
`MATCH EXTENSIONS
`
`iptables can use extended packet matching modules. These are loaded in two ways: implicitly, when
`-p or --protocol is specified, or with the -m or --match options, followed by the matching module
`name; after these, various extra command line options become available, depending on the specific
`module. You can specify multiple extended match modules in one line, and you can use the -h or --
`help options after the module has been specified to receive help specific to that module.
`
`The following are included in the base package, and most of these can be preceded by a ! to invert the
`sense of the match.
`
`MCM Ex. 2007, pg. 5
`
`

`

`addrtype
`
`This module matches packets based on their address type. Address types are used within the kernel
`networking stack and categorize addresses into various groups. The exact definition of that group
`depends on the specific layer three protocol.
`
`The following address types are possible:
`UNSPEC
`an unspecified address (i.e. 0.0.0.0) UNICAST an unicast address LOCAL a local address
`BROADCAST a broadcast address ANYCAST an anycast packet MULTICAST a multicast
`address BLACKHOLE a blackhole address UNREACHABLE an unreachable address
`PROHIBIT a prohibited address THROW FIXME NAT FIXME XRESOLVE FIXME
`--src-type type
`Matches if the source address is of given type
`--dst-type type
`Matches if the destination address is of given type
`
`ah
`
`This module matches the SPIs in AH header of IPSec packets.
`
`--ahspi [!] spi[:spi]
`
`childlevel
`
`This is an experimental module. It matches on whether the packet is part of a master connection or
`one of its children (or grandchildren, etc). For instance, most packets are level 0. FTP data transfer is
`level 1.
`
`--childlevel [!] level
`
`condition
`
`This matches if a specific /proc filename is '0' or '1'.
`
`--condition [!] filename
`Match on boolean value stored in /proc/net/ipt_condition/filename file
`
`MCM Ex. 2007, pg. 6
`
`

`

`connmark
`
`This module matches the netfilter mark field associated with a connection (which can be set using the
`CONNMARK target below).
`
`--mark value[/mask]
`Matches packets in connections with the given mark value (if a mask is specified, this is
`logically ANDed with the mark before the comparison).
`
`connrate
`
`This module matches the current transfer rate in a connection.
`
`--connrate [!] [from]:[to]
`Match against the current connection transfer rate being within 'from' and 'to' bytes per second.
`When the "!" argument is used before the range, the sense of the match is inverted.
`
`conntrack
`
`This module, when combined with connection tracking, allows access to more connection tracking
`information than the "state" match. (this module is present only if iptables was compiled under a
`kernel supporting this feature)
`
`--ctstate state
`Where state is a comma separated list of the connection states to match. Possible states are
`INVALID meaning that the packet is associated with no known connection, ESTABLISHED
`meaning that the packet is associated with a connection which has seen packets in both
`directions, NEW meaning that the packet has started a new connection, or otherwise associated
`with a connection which has not seen packets in both directions, and RELATED meaning that
`the packet is starting a new connection, but is associated with an existing connection, such as an
`FTP data transfer, or an ICMP error. SNAT A virtual state, matching if the original source
`address differs from the reply destination. DNAT A virtual state, matching if the original
`destination differs from the reply source.
`--ctproto proto
`Protocol to match (by number or name)
`--ctorigsrc [!] address[/mask]
`Match against original source address
`--ctorigdst [!] address[/mask]
`Match against original destination address
`--ctreplsrc [!] address[/mask]
`Match against reply source address
`--ctrepldst [!] address[/mask]
`Match against reply destination address
`--ctstatus [NONE|EXPECTED|SEEN_REPLY|ASSURED][,...]
`Match against internal conntrack states
`
`MCM Ex. 2007, pg. 7
`
`

`

`--ctexpire time[:time]
`Match remaining lifetime in seconds against given value or range of values (inclusive)
`
`dscp
`
`This module matches the 6 bit DSCP field within the TOS field in the IP header. DSCP has
`superseded TOS within the IETF.
`
`--dscp value
`Match against a numeric (decimal or hex) value [0-32].
`--dscp-class DiffServ Class
`Match the DiffServ class. This value may be any of the BE, EF, AFxx or CSx classes. It will
`then be converted into it's according numeric value.
`
`dstlimit
`
`This module allows you to limit the packet per second (pps) rate on a per destination IP or per
`destination port base. As opposed to the `limit' match, every destination ip / destination port has it's
`own limit.
`
`--dstlimit avg
`Maximum average match rate (packets per second unless followed by /sec /minute /hour /day
`postfixes).
`--dstlimit-mode mode
`The limiting hashmode. Is the specified limit per dstip, dstip-dstport tuple, srcip-dstip tuple,
`or per srcipdstip-dstport tuple.
`--dstlimit-name name
`Name for /proc/net/ipt_dstlimit/* file entry
`[--dstlimit-burst burst]
`Number of packets to match in a burst. Default: 5
`[--dstlimit-htable-size size]
`Number of buckets in the hashtable
`[--dstlimit-htable-max max]
`Maximum number of entries in the hashtable
`[--dstlimit-htable-gcinterval interval]
`Interval between garbage collection runs of the hashtable (in miliseconds). Default is 1000 (1
`second).
`[--dstlimit-htable-expire time
`After which time are idle entries expired from hashtable (in miliseconds)? Default is 10000 (10
`seconds).
`
`MCM Ex. 2007, pg. 8
`
`

`

`ecn
`
`This allows you to match the ECN bits of the IPv4 and TCP header. ECN is the Explicit Congestion
`Notification mechanism as specified in RFC3168
`
`--ecn-tcp-cwr
`This matches if the TCP ECN CWR (Congestion Window Received) bit is set.
`--ecn-tcp-ece
`This matches if the TCP ECN ECE (ECN Echo) bit is set.
`--ecn-ip-ect num
`This matches a particular IPv4 ECT (ECN-Capable Transport). You have to specify a number
`between `0' and `3'.
`
`esp
`
`This module matches the SPIs in ESP header of IPSec packets.
`
`--espspi [!] spi[:spi]
`
`fuzzy
`
`This module matches a rate limit based on a fuzzy logic controller [FLC]
`
`--lower-limit number
`Specifies the lower limit (in packets per second).
`--upper-limit number
`Specifies the upper limit (in packets per second).
`
`helper
`
`This module matches packets related to a specific conntrack-helper.
`
`--helper string
`Matches packets related to the specified conntrack-helper.
`
`string can be "ftp" for packets related to a ftp-session on default port. For other ports
`append -portnr to the value, ie. "ftp-2121".
`
`Same rules apply for other conntrack-helpers.
`
`MCM Ex. 2007, pg. 9
`
`

`

`icmp
`
`This extension is loaded if `--protocol icmp' is specified. It provides the following option:
`
`--icmp-type [!] typename
`This allows specification of the ICMP type, which can be a numeric ICMP type, or one of the
`ICMP type names shown by the command
`
` iptables -p icmp -h
`
`iprange
`
`This matches on a given arbitrary range of IPv4 addresses
`
`[!]--src-range ip-ip
`Match source IP in the specified range.
`[!]--dst-range ip-ip
`Match destination IP in the specified range.
`
`length
`
`This module matches the length of a packet against a specific value or range of values.
`
`--length length[:length]
`
`limit
`
`This module matches at a limited rate using a token bucket filter. A rule using this extension will
`match until this limit is reached (unless the `!' flag is used). It can be used in combination with the
`LOG target to give limited logging, for example.
`
`--limit rate
`Maximum average matching rate: specified as a number, with an optional `/second', `/minute',
``/hour', or `/day' suffix; the default is 3/hour.
`--limit-burst number
`Maximum initial number of packets to match: this number gets recharged by one every time the
`limit specified above is not reached, up to this number; the default is 5.
`
`mac
`
`--mac-source [!] address
`
`MCM Ex. 2007, pg. 10
`
`

`

`Match source MAC address. It must be of the form XX:XX:XX:XX:XX:XX. Note that this
`only makes sense for packets coming from an Ethernet device and entering the
`PREROUTING, FORWARD or INPUT chains.
`
`mark
`
`This module matches the netfilter mark field associated with a packet (which can be set using the
`MARK target below).
`
`--mark value[/mask]
`Matches packets with the given unsigned mark value (if a mask is specified, this is logically
`ANDed with the mask before the comparison).
`
`mport
`
`This module matches a set of source or destination ports. Up to 15 ports can be specified. It can only
`be used in conjunction with -p tcp or -p udp.
`
`--source-ports port[,port[,port...]]
`Match if the source port is one of the given ports. The flag --sports is a convenient alias for this
`option.
`--destination-ports port[,port[,port...]]
`Match if the destination port is one of the given ports. The flag --dports is a convenient alias
`for this option.
`--ports port[,port[,port...]]
`Match if the both the source and destination ports are equal to each other and to one of the
`given ports.
`
`multiport
`
`This module matches a set of source or destination ports. Up to 15 ports can be specified. It can only
`be used in conjunction with -p tcp or -p udp.
`
`--source-ports port[,port[,port...]]
`Match if the source port is one of the given ports. The flag --sports is a convenient alias for this
`option.
`--destination-ports port[,port[,port...]]
`Match if the destination port is one of the given ports. The flag --dports is a convenient alias
`for this option.
`--ports port[,port[,port...]]
`Match if the both the source and destination ports are equal to each other and to one of the
`given ports.
`
`MCM Ex. 2007, pg. 11
`
`

`

`nth
`
`This module matches every `n'th packet
`
`--every value
`Match every `value' packet
`[--counter num]
`Use internal counter number `num'. Default is `0'.
`[--start num]
`Initialize the counter at the number `num' insetad of `0'. Most between `0' and `value'-1.
`[--packet num]
`Match on `num' packet. Most be between `0' and `value'-1.
`
`owner
`
`This module attempts to match various characteristics of the packet creator, for locally-generated
`packets. It is only valid in the OUTPUT chain, and even this some packets (such as ICMP ping
`responses) may have no owner, and hence never match.
`
`--uid-owner userid
`Matches if the packet was created by a process with the given effective user id.
`--gid-owner groupid
`Matches if the packet was created by a process with the given effective group id.
`--pid-owner processid
`Matches if the packet was created by a process with the given process id.
`--sid-owner sessionid
`Matches if the packet was created by a process in the given session group.
`--cmd-owner name
`Matches if the packet was created by a process with the given command name. (this option is
`present only if iptables was compiled under a kernel supporting this feature)
`NOTE: pid, sid and command matching are broken on SMP
`
`physdev
`
`This module matches on the bridge port input and output devices enslaved to a bridge device. This
`module is a part of the infrastructure that enables a transparent bridging IP firewall and is only useful
`for kernel versions above version 2.5.44.
`
`--physdev-in name
`Name of a bridge port via which a packet is received (only for packets entering the INPUT,
`FORWARD and PREROUTING chains). If the interface name ends in a "+", then any
`interface which begins with this name will match. If the packet didn't arrive through a bridge
`device, this packet won't match this option, unless '!' is used.
`
`MCM Ex. 2007, pg. 12
`
`

`

`--physdev-out name
`Name of a bridge port via which a packet is going to be sent (for packets entering the
`FORWARD, OUTPUT and POSTROUTING chains). If the interface name ends in a "+",
`then any interface which begins with this name will match. Note that in the nat and mangle
`OUTPUT chains one cannot match on the bridge output port, however one can in the filter
`OUTPUT chain. If the packet won't leave by a bridge device or it is yet unknown what the
`output device will be, then the packet won't match this option, unless
`--physdev-is-in
`Matches if the packet has entered through a bridge interface.
`--physdev-is-out
`Matches if the packet will leave through a bridge interface.
`--physdev-is-bridged
`Matches if the packet is being bridged and therefore is not being routed. This is only useful in
`the FORWARD and POSTROUTING chains.
`
`pkttype
`
`This module matches the link-layer packet type.
`
`--pkt-type [unicast|broadcast|multicast]
`
`random
`
`This module randomly matches a certain percentage of all packets.
`
`--average percent
`Matches the given percentage. If omitted, a probability of 50% is set.
`
`realm
`
`This matches the routing realm. Routing realms are used in complex routing setups involving
`dynamic routing protocols like BGP.
`
`--realm [!]value[/mask]
`Matches a given realm number (and optionally mask).
`
`set
`
`This modules macthes IP sets which can be defined by ipset(8).
`
`--set setname flag[,flag...]
`
`MCM Ex. 2007, pg. 13
`
`

`

`where flags are src and/or dst and there can be no more than six of them. Hence the command
`
` iptables ­A FORWARD ­m set ­­set test src,dst
`will match packets, for which (depending on the type of the set) the source address or port
`number of the packet can be found in the specified set. If there is a binding belonging to the
`mached set element or there is a default binding for the given set, then the rule will match the
`packet only if additionally (depending on the type of the set) the destination address or port
`number of the packet can be found in the set according to the binding.
`
`state
`
`This module, when combined with connection tracking, allows access to the connection tracking state
`for this packet.
`
`--state state
`Where state is a comma separated list of the connection states to match. Possible states are
`INVALID meaning that the packet could not be identified for some reason which includes
`running out of memory and ICMP errors which don't correspond to any known connection,
`ESTABLISHED meaning that the packet is associated with a connection which has seen
`packets in both directions, NEW meaning that the packet has started a new connection, or
`otherwise associated with a connection which has not seen packets in both directions, and
`RELATED meaning that the packet is starting a new connection, but is associated with an
`existing connection, such as an FTP data transfer, or an ICMP error.
`
`tcp
`
`These extensions are loaded if `--protocol tcp' is specified. It provides the following options:
`
`--source-port [!] port[:port]
`Source port or port range specification. This can either be a service name or a port number. An
`inclusive range can also be specified, using the format port:port. If the first port is omitted, "0"
`is assumed; if the last is omitted, "65535" is assumed. If the second port greater then the first
`they will be swapped. The flag --sport is a convenient alias for this option.
`--destination-port [!] port[:port]
`Destination port or port range specification. The flag --dport is a convenient alias for this
`option.
`--tcp-flags [!] mask comp
`Match when the TCP flags are as specified. The first argument is the flags which we should
`examine, written as a comma-separated list, and the second argument is a comma-separated list
`of flags which must be set. Flags are: SYN ACK FIN RST URG PSH ALL NONE. Hence the
`command
`
` iptables ­A FORWARD ­p tcp ­­tcp­flags SYN,ACK,FIN,RST SYN
`will only match packets with the SYN flag set, and the ACK, FIN and RST flags unset.
`[!] --syn
`
`MCM Ex. 2007, pg. 14
`
`

`

`Only match TCP packets with the SYN bit set and the ACK and RST bits cleared. Such packets
`are used to request TCP connection initiation; for example, blocking such packets coming in an
`interface will prevent incoming TCP connections, but outgoing TCP connections will be
`unaffected. It is equivalent to --tcp-flags SYN,RST,ACK SYN. If the "!" flag precedes the "--
`syn", the sense of the option is inverted.
`--tcp-option [!] number
`Match if TCP option set.
`--mss value[:value]
`Match TCP SYN or SYN/ACK packets with the specified MSS value (or range), which control
`the maximum packet size for that connection.
`
`tcpmss
`
`This matches the TCP MSS (maximum segment size) field of the TCP header. You can only use this
`on TCP SYN or SYN/ACK packets, since the MSS is only negotiated during the TCP handshake at
`connection startup time.
`
`[!] --mss value[:value]
`Match a given TCP MSS value or range.
`
`time
`
`This matches if the packet arrival time/date is within a given range. All options are facultative.
`
`--timestart value
`Match only if it is after `value' (Inclusive, format: HH:MM ; default 00:00).
`--timestop value
`Match only if it is before `value' (Inclusive, format: HH:MM ; default 23:59).
`--days listofdays
`Match only if today is one of the given days. (format: Mon,Tue,Wed,Thu,Fri,Sat,Sun ; default
`everyday)
`--datestart date
`Match only if it is after `date' (Inclusive, format: YYYY[:MM[:DD[:hh[:mm[:ss]]]]] ; h,m,s
`start from 0 ; default to 1970)
`--datestop date
`Match only if it is before `date' (Inclusive, format: YYYY[:MM[:DD[:hh[:mm[:ss]]]]] ; h,m,s
`start from 0 ; default to 2037)
`
`tos
`
`This module matches the 8 bits of Type of Service field in the IP header (ie. including the precedence
`bits).
`
`MCM Ex. 2007, pg. 15
`
`

`

`--tos tos
`The argument is either a standard name, (use
`
` iptables -m tos -h
`to see the list), or a numeric value to match.
`
`ttl
`
`This module matches the time to live field in the IP header.
`
`--ttl-eq ttl
`Matches the given TTL value.
`--ttl-gt ttl
`Matches if TTL is greater than the given TTL value.
`--ttl-lt ttl
`Matches if TTL is less than the given TTL value.
`
`udp
`
`These extensions are loaded if `--protocol udp' is specified. It provides the following options:
`
`--source-port [!] port[:port]
`Source port or port range specification. See the description of the --source-port option of the
`TCP extension for details.
`--destination-port [!] port[:port]
`Destination port or port range specification. See the description of the --destination-port
`option of the TCP extension for details.
`
`unclean
`
`This module takes no options, but attempts to match packets which seem malformed or unusual. This
`is regarded as experimental.
`TARGET EXTENSIONS
`
`iptables can use extended target modules: the following are included in the standard distribution.
`
`BALANCE
`
`This allows you to DNAT connections in a round-robin way over a given range of destination
`addresses.
`
`MCM Ex. 2007, pg. 16
`
`

`

`--to-destination ipaddr-ipaddr
`Address range to round-robin over.
`
`CLASSIFY
`
`This module allows you to set the skb->priority value (and thus classify the packet into a specific
`CBQ class).
`
`--set-class MAJOR:MINOR
`Set the major and minor class value.
`
`CLUSTERIP
`
`This module allows you to configure a simple cluster of nodes that share a certain IP and MAC
`address without an explicit load balancer in front of them. Connections are statically distributed
`between the nodes in this cluster.
`
`--new
`Create a new ClusterIP. You always have to set this on the first rule for a given ClusterIP.
`--hashmode mode
`Specify the hashing mode. Has to be one of sourceip, sourceip-sourceport, sourceip-
`sourceport-destport
`--clustermac mac
`Specify the ClusterIP MAC address. Has to be a link-layer multicast address
`--total-nodes num
`Number of total nodes within this cluster.
`--local-node num
`Local node number within this cluster.
`--hash-init rnd
`Specify the random seed used for hash initialization.
`
`CONNMARK
`
`This module sets the netfilter mark value associated with a connection
`
`--set-mark mark[/mask]
`Set connection mark. If a mask is specified then only those bits set in the mask is modified.
`--save-mark [--mask mask]
`Copy the netfilter packet mark value to the connection mark. If a mask is specified then only
`those bits are copied.
`--restore-mark [--mask mask]
`Copy the connection mark value to the packet. If a mask is specified then only those bits are
`copied. This is only valid in the mangle table.
`
`MCM Ex. 2007, pg. 17
`
`

`

`DNAT
`
`This target is only valid in the nat table, in the PREROUTING and OUTPUT chains, and user-
`defined chains which are only called from those chains. It specifies that the destination address of the
`packet should be modified (and all future packets in this connection will also be mangled), and rules
`should cease being examined. It takes one type of option:
`
`--to-destination ipaddr[-ipaddr][:port-port]
`which can specify a single new destination IP address, an inclusive range of IP addresses, and
`optionally, a port range (which is only valid if the rule also specifies -p tcp or -p udp). If no
`port range is specified, then the destination port will never be modified.
`
`You can add several --to-destination options. If you specify more than one destination
`address, either via an address range or multiple --to-destination options, a simple round-
`robin (one after another in cycle) load balancing takes place between these adresses.
`
`DSCP
`
`This target allows to alter the value of the DSCP b