551 lines
23 KiB
HTML
551 lines
23 KiB
HTML
|
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
<HTML><HEAD><TITLE>Man page of IPTABLES</TITLE>
|
|
</HEAD><BODY>
|
|
<H1>IPTABLES</H1>
|
|
Section: iptables 1.8.4 (8)<BR>Updated: <BR><A HREF="#index">Index</A>
|
|
<A HREF="/cgi-bin/man/man2html">Return to Main Contents</A><HR>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<A NAME="lbAB"> </A>
|
|
<H2>NAME</H2>
|
|
|
|
iptables/ip6tables --- administration tool for IPv4/IPv6 packet filtering and NAT
|
|
<A NAME="lbAC"> </A>
|
|
<H2>SYNOPSIS</H2>
|
|
|
|
<B>iptables</B> [<B>-t</B> <I>table</I>] {<B>-A</B>|<B>-C</B>|<B>-D</B>}
|
|
<I>chain</I> <I>rule-specification</I>
|
|
<P>
|
|
|
|
<B>ip6tables</B> [<B>-t</B> <I>table</I>] {<B>-A</B>|<B>-C</B>|<B>-D</B>}
|
|
<I>chain rule-specification</I>
|
|
<P>
|
|
|
|
<B>iptables</B> [<B>-t</B> <I>table</I>] <B>-I</B> <I>chain</I> [<I>rulenum</I>] <I>rule-specification</I>
|
|
<P>
|
|
|
|
<B>iptables</B> [<B>-t</B> <I>table</I>] <B>-R</B> <I>chain rulenum rule-specification</I>
|
|
<P>
|
|
|
|
<B>iptables</B> [<B>-t</B> <I>table</I>] <B>-D</B> <I>chain rulenum</I>
|
|
<P>
|
|
|
|
<B>iptables</B> [<B>-t</B> <I>table</I>] <B>-S</B> [<I>chain</I> [<I>rulenum</I>]]
|
|
<P>
|
|
|
|
<B>iptables</B> [<B>-t</B> <I>table</I>] {<B>-F</B>|<B>-L</B>|<B>-Z</B>} [<I>chain</I> [<I>rulenum</I>]] [<I>options...</I>]
|
|
<P>
|
|
|
|
<B>iptables</B> [<B>-t</B> <I>table</I>] <B>-N</B> <I>chain</I>
|
|
<P>
|
|
|
|
<B>iptables</B> [<B>-t</B> <I>table</I>] <B>-X</B> [<I>chain</I>]
|
|
<P>
|
|
|
|
<B>iptables</B> [<B>-t</B> <I>table</I>] <B>-P</B> <I>chain target</I>
|
|
<P>
|
|
|
|
<B>iptables</B> [<B>-t</B> <I>table</I>] <B>-E</B> <I>old-chain-name new-chain-name</I>
|
|
<P>
|
|
|
|
rule-specification = [<I>matches...</I>] [<I>target</I>]
|
|
<P>
|
|
|
|
match = <B>-m</B> <I>matchname</I> [<I>per-match-options</I>]
|
|
<P>
|
|
|
|
target = <B>-j</B> <I>targetname</I> [<I>per-target-options</I>]
|
|
<A NAME="lbAD"> </A>
|
|
<H2>DESCRIPTION</H2>
|
|
|
|
<B>Iptables</B> and <B>ip6tables</B> are used to set up, maintain, and inspect the
|
|
tables of IPv4 and IPv6 packet
|
|
filter rules in the Linux kernel. Several different tables
|
|
may be defined. Each table contains a number of built-in
|
|
chains and may also contain user-defined chains.
|
|
<P>
|
|
|
|
Each chain is a list of rules which can match a set of packets. Each
|
|
rule specifies what to do with a packet that matches. This is called
|
|
a `target', which may be a jump to a user-defined chain in the same
|
|
table.
|
|
<A NAME="lbAE"> </A>
|
|
<H2>TARGETS</H2>
|
|
|
|
A firewall rule specifies criteria for a packet and a target. If the
|
|
packet does not match, the next rule in the chain is examined; if
|
|
it does match, then the next rule is specified by the value of the
|
|
target, which can be the name of a user-defined chain, one of the targets
|
|
described in <B><A HREF="/cgi-bin/man/man2html?8+iptables-extensions">iptables-extensions</A></B>(8), or one of the
|
|
special values <B>ACCEPT</B>, <B>DROP</B> or <B>RETURN</B>.
|
|
<P>
|
|
|
|
<B>ACCEPT</B> means to let the packet through.
|
|
<B>DROP</B> means to drop the packet on the floor.
|
|
<B>RETURN</B> means stop traversing this chain and resume at the next
|
|
rule in the
|
|
previous (calling) chain. If the end of a built-in chain is reached
|
|
or a rule in a built-in chain with target <B>RETURN</B>
|
|
is matched, the target specified by the chain policy determines the
|
|
fate of the packet.
|
|
<A NAME="lbAF"> </A>
|
|
<H2>TABLES</H2>
|
|
|
|
There are currently five independent tables (which tables are present
|
|
at any time depends on the kernel configuration options and which
|
|
modules are present).
|
|
<DL COMPACT>
|
|
<DT id="1"><B>-t</B>, <B>--table</B> <I>table</I><DD>
|
|
This option specifies the packet matching table which the command
|
|
should operate on. If the kernel is configured with automatic module
|
|
loading, an attempt will be made to load the appropriate module for
|
|
that table if it is not already there.
|
|
<P>
|
|
The tables are as follows:
|
|
<DL COMPACT><DT id="2"><DD>
|
|
<DL COMPACT>
|
|
<DT id="3"><B>filter</B>:<DD>
|
|
This is the default table (if no -t option is passed). It contains
|
|
the built-in chains <B>INPUT</B> (for packets destined to local sockets),
|
|
<B>FORWARD</B> (for packets being routed through the box), and
|
|
<B>OUTPUT</B> (for locally-generated packets).
|
|
<DT id="4"><B>nat</B>:<DD>
|
|
This table is consulted when a packet that creates a new
|
|
connection is encountered. It consists of four built-ins: <B>PREROUTING</B>
|
|
(for altering packets as soon as they come in), <B>INPUT</B> (for altering
|
|
packets destined for local sockets), <B>OUTPUT</B>
|
|
(for altering locally-generated packets before routing), and <B>POSTROUTING</B>
|
|
(for altering packets as they are about to go out).
|
|
IPv6 NAT support is available since kernel 3.7.
|
|
<DT id="5"><B>mangle</B>:<DD>
|
|
This table is used for specialized packet alteration. Until kernel
|
|
2.4.17 it had two built-in chains: <B>PREROUTING</B>
|
|
(for altering incoming packets before routing) and <B>OUTPUT</B>
|
|
(for altering locally-generated packets before routing).
|
|
Since kernel 2.4.18, three other built-in chains are also supported:
|
|
<B>INPUT</B> (for packets coming into the box itself), <B>FORWARD</B>
|
|
(for altering packets being routed through the box), and <B>POSTROUTING</B>
|
|
(for altering packets as they are about to go out).
|
|
<DT id="6"><B>raw</B>:<DD>
|
|
This table is used mainly for configuring exemptions from connection
|
|
tracking in combination with the NOTRACK target. It registers at the netfilter
|
|
hooks with higher priority and is thus called before ip_conntrack, or any other
|
|
IP tables. It provides the following built-in chains: <B>PREROUTING</B>
|
|
(for packets arriving via any network interface) <B>OUTPUT</B>
|
|
(for packets generated by local processes)
|
|
<DT id="7"><B>security</B>:<DD>
|
|
This table is used for Mandatory Access Control (MAC) networking rules, such
|
|
as those enabled by the <B>SECMARK</B> and <B>CONNSECMARK</B> targets.
|
|
Mandatory Access Control is implemented by Linux Security Modules such as
|
|
SELinux. The security table is called after the filter table, allowing any
|
|
Discretionary Access Control (DAC) rules in the filter table to take effect
|
|
before MAC rules. This table provides the following built-in chains:
|
|
<B>INPUT</B> (for packets coming into the box itself),
|
|
<B>OUTPUT</B> (for altering locally-generated packets before routing), and
|
|
<B>FORWARD</B> (for altering packets being routed through the box).
|
|
</DL>
|
|
</DL>
|
|
|
|
</DL>
|
|
<A NAME="lbAG"> </A>
|
|
<H2>OPTIONS</H2>
|
|
|
|
The options that are recognized by
|
|
<B>iptables</B> and <B>ip6tables</B> can be divided into several different groups.
|
|
<A NAME="lbAH"> </A>
|
|
<H3>COMMANDS</H3>
|
|
|
|
These options specify the desired action to perform. Only one of them
|
|
can be specified on the command line unless otherwise stated
|
|
below. For long versions of the command and option names, you
|
|
need to use only enough letters to ensure that
|
|
<B>iptables</B> can differentiate it from all other options.
|
|
<DL COMPACT>
|
|
<DT id="8"><B>-A</B>, <B>--append</B> <I>chain rule-specification</I><DD>
|
|
Append one or more rules to the end of the selected chain.
|
|
When the source and/or destination names resolve to more than one
|
|
address, a rule will be added for each possible address combination.
|
|
<DT id="9"><B>-C</B>, <B>--check</B> <I>chain rule-specification</I><DD>
|
|
Check whether a rule matching the specification does exist in the
|
|
selected chain. This command uses the same logic as <B>-D</B> to
|
|
find a matching entry, but does not alter the existing iptables
|
|
configuration and uses its exit code to indicate success or failure.
|
|
<DT id="10"><B>-D</B>, <B>--delete</B> <I>chain rule-specification</I><DD>
|
|
|
|
<DT id="11"><B>-D</B>, <B>--delete</B> <I>chain rulenum</I><DD>
|
|
Delete one or more rules from the selected chain. There are two
|
|
versions of this command: the rule can be specified as a number in the
|
|
chain (starting at 1 for the first rule) or a rule to match.
|
|
<DT id="12"><B>-I</B>, <B>--insert</B> <I>chain</I> [<I>rulenum</I>] <I>rule-specification</I><DD>
|
|
Insert one or more rules in the selected chain as the given rule
|
|
number. So, if the rule number is 1, the rule or rules are inserted
|
|
at the head of the chain. This is also the default if no rule number
|
|
is specified.
|
|
<DT id="13"><B>-R</B>, <B>--replace</B> <I>chain rulenum rule-specification</I><DD>
|
|
Replace a rule in the selected chain. If the source and/or
|
|
destination names resolve to multiple addresses, the command will
|
|
fail. Rules are numbered starting at 1.
|
|
<DT id="14"><B>-L</B>, <B>--list</B> [<I>chain</I>]<DD>
|
|
List all rules in the selected chain. If no chain is selected, all
|
|
chains are listed. Like every other iptables command, it applies to the
|
|
specified table (filter is the default), so NAT rules get listed by
|
|
<PRE>
|
|
iptables -t nat -n -L
|
|
</PRE>
|
|
|
|
Please note that it is often used with the <B>-n</B>
|
|
option, in order to avoid long reverse DNS lookups.
|
|
It is legal to specify the <B>-Z</B>
|
|
(zero) option as well, in which case the chain(s) will be atomically
|
|
listed and zeroed. The exact output is affected by the other
|
|
arguments given. The exact rules are suppressed until you use
|
|
<PRE>
|
|
iptables -L -v
|
|
</PRE>
|
|
|
|
or
|
|
<B><A HREF="/cgi-bin/man/man2html?8+iptables-save">iptables-save</A></B>(8).
|
|
<DT id="15"><B>-S</B>, <B>--list-rules</B> [<I>chain</I>]<DD>
|
|
Print all rules in the selected chain. If no chain is selected, all
|
|
chains are printed like iptables-save. Like every other iptables command,
|
|
it applies to the specified table (filter is the default).
|
|
<DT id="16"><B>-F</B>, <B>--flush</B> [<I>chain</I>]<DD>
|
|
Flush the selected chain (all the chains in the table if none is given).
|
|
This is equivalent to deleting all the rules one by one.
|
|
<DT id="17"><B>-Z</B>, <B>--zero</B> [<I>chain</I> [<I>rulenum</I>]]<DD>
|
|
Zero the packet and byte counters in all chains, or only the given chain,
|
|
or only the given rule in a chain. It is legal to
|
|
specify the
|
|
<B>-L</B>, <B>--list</B>
|
|
(list) option as well, to see the counters immediately before they are
|
|
cleared. (See above.)
|
|
<DT id="18"><B>-N</B>, <B>--new-chain</B> <I>chain</I><DD>
|
|
Create a new user-defined chain by the given name. There must be no
|
|
target of that name already.
|
|
<DT id="19"><B>-X</B>, <B>--delete-chain</B> [<I>chain</I>]<DD>
|
|
Delete the optional user-defined chain specified. There must be no references
|
|
to the chain. If there are, you must delete or replace the referring rules
|
|
before the chain can be deleted. The chain must be empty, i.e. not contain
|
|
any rules. If no argument is given, it will attempt to delete every
|
|
non-builtin chain in the table.
|
|
<DT id="20"><B>-P</B>, <B>--policy</B> <I>chain target</I><DD>
|
|
Set the policy for the built-in (non-user-defined) chain to the given target.
|
|
The policy target must be either <B>ACCEPT</B> or <B>DROP</B>.
|
|
<DT id="21"><B>-E</B>, <B>--rename-chain</B> <I>old-chain new-chain</I><DD>
|
|
Rename the user specified chain to the user supplied name. This is
|
|
cosmetic, and has no effect on the structure of the table.
|
|
<DT id="22"><B>-h</B><DD>
|
|
Help.
|
|
Give a (currently very brief) description of the command syntax.
|
|
</DL>
|
|
<A NAME="lbAI"> </A>
|
|
<H3>PARAMETERS</H3>
|
|
|
|
The following parameters make up a rule specification (as used in the
|
|
add, delete, insert, replace and append commands).
|
|
<DL COMPACT>
|
|
<DT id="23"><B>-4</B>, <B>--ipv4</B><DD>
|
|
This option has no effect in iptables and iptables-restore.
|
|
If a rule using the <B>-4</B> option is inserted with (and only with)
|
|
ip6tables-restore, it will be silently ignored. Any other uses will throw an
|
|
error. This option allows IPv4 and IPv6 rules in a single rule file
|
|
for use with both iptables-restore and ip6tables-restore.
|
|
<DT id="24"><B>-6</B>, <B>--ipv6</B><DD>
|
|
If a rule using the <B>-6</B> option is inserted with (and only with)
|
|
iptables-restore, it will be silently ignored. Any other uses will throw an
|
|
error. This option allows IPv4 and IPv6 rules in a single rule file
|
|
for use with both iptables-restore and ip6tables-restore.
|
|
This option has no effect in ip6tables and ip6tables-restore.
|
|
<DT id="25">[<B>!</B>] <B>-p</B>, <B>--protocol</B> <I>protocol</I><DD>
|
|
The protocol of the rule or of the packet to check.
|
|
The specified protocol can be one of <B>tcp</B>, <B>udp</B>, <B>udplite</B>,
|
|
<B>icmp</B>, <B>icmpv6</B>,<B>esp</B>, <B>ah</B>, <B>sctp</B>, <B>mh</B> or the special keyword "<B>all</B>",
|
|
or it can be a numeric value, representing one of these protocols or a
|
|
different one. A protocol name from /etc/protocols is also allowed.
|
|
A "!" argument before the protocol inverts the
|
|
test. The number zero is equivalent to <B>all</B>. "<B>all</B>"
|
|
will match with all protocols and is taken as default when this
|
|
option is omitted.
|
|
Note that, in ip6tables, IPv6 extension headers except <B>esp</B> are not allowed.
|
|
<B>esp</B> and <B>ipv6-nonext</B>
|
|
can be used with Kernel version 2.6.11 or later.
|
|
The number zero is equivalent to <B>all</B>, which means that you cannot
|
|
test the protocol field for the value 0 directly. To match on a HBH header,
|
|
even if it were the last, you cannot use <B>-p 0</B>, but always need
|
|
<B>-m hbh</B>.
|
|
<DT id="26">[<B>!</B>] <B>-s</B>, <B>--source</B> <I>address</I>[<B>/</B><I>mask</I>][<B>,</B><I>...</I>]<DD>
|
|
Source specification. <I>Address</I>
|
|
can be either a network name, a hostname, a network IP address (with
|
|
<B>/</B><I>mask</I>), or a plain IP address. Hostnames will
|
|
be resolved once only, before the rule is submitted to the kernel.
|
|
Please note that specifying any name to be resolved with a remote query such as
|
|
DNS is a really bad idea.
|
|
The <I>mask</I>
|
|
can be either an ipv4 network mask (for iptables) or a plain number,
|
|
specifying the number of 1's at the left side of the network mask.
|
|
Thus, an iptables mask of <I>24</I> is equivalent to <I>255.255.255.0</I>.
|
|
A "!" argument before the address specification inverts the sense of
|
|
the address. The flag <B>--src</B> is an alias for this option.
|
|
Multiple addresses can be specified, but this will <B>expand to multiple
|
|
rules</B> (when adding with -A), or will cause multiple rules to be
|
|
deleted (with -D).
|
|
<DT id="27">[<B>!</B>] <B>-d</B>, <B>--destination</B> <I>address</I>[<B>/</B><I>mask</I>][<B>,</B><I>...</I>]<DD>
|
|
Destination specification.
|
|
See the description of the <B>-s</B>
|
|
(source) flag for a detailed description of the syntax. The flag
|
|
<B>--dst</B> is an alias for this option.
|
|
<DT id="28"><B>-m</B>, <B>--match</B> <I>match</I><DD>
|
|
Specifies a match to use, that is, an extension module that tests for a
|
|
specific property. The set of matches make up the condition under which a
|
|
target is invoked. Matches are evaluated first to last as specified on the
|
|
command line and work in short-circuit fashion, i.e. if one extension yields
|
|
false, evaluation will stop.
|
|
<DT id="29"><B>-j</B>, <B>--jump</B> <I>target</I><DD>
|
|
This specifies the target of the rule; i.e., what to do if the packet
|
|
matches it. The target can be a user-defined chain (other than the
|
|
one this rule is in), one of the special builtin targets which decide
|
|
the fate of the packet immediately, or an extension (see <B>EXTENSIONS</B>
|
|
below). If this
|
|
option is omitted in a rule (and <B>-g</B>
|
|
is not used), then matching the rule will have no
|
|
effect on the packet's fate, but the counters on the rule will be
|
|
incremented.
|
|
<DT id="30"><B>-g</B>, <B>--goto</B> <I>chain</I><DD>
|
|
This specifies that the processing should continue in a user
|
|
specified chain. Unlike the --jump option return will not continue
|
|
processing in this chain but instead in the chain that called us via
|
|
--jump.
|
|
<DT id="31">[<B>!</B>] <B>-i</B>, <B>--in-interface</B> <I>name</I><DD>
|
|
Name of an interface via which a packet was received (only for
|
|
packets entering the <B>INPUT</B>, <B>FORWARD</B> and <B>PREROUTING</B>
|
|
chains). When the "!" argument is used before the interface name, the
|
|
sense is inverted. If the interface name ends in a "+", then any
|
|
interface which begins with this name will match. If this option is
|
|
omitted, any interface name will match.
|
|
<DT id="32">[<B>!</B>] <B>-o</B>, <B>--out-interface</B> <I>name</I><DD>
|
|
Name of an interface via which a packet is going to be sent (for packets
|
|
entering the <B>FORWARD</B>, <B>OUTPUT</B> and <B>POSTROUTING</B>
|
|
chains). When the "!" argument is used before the interface name, the
|
|
sense is inverted. If the interface name ends in a "+", then any
|
|
interface which begins with this name will match. If this option is
|
|
omitted, any interface name will match.
|
|
<DT id="33">[<B>!</B>] <B>-f</B>, <B>--fragment</B><DD>
|
|
This means that the rule only refers to second and further IPv4 fragments
|
|
of fragmented packets. Since there is no way to tell the source or
|
|
destination ports of such a packet (or ICMP type), such a packet will
|
|
not match any rules which specify them. When the "!" argument
|
|
precedes the "-f" flag, the rule will only match head fragments, or
|
|
unfragmented packets. This option is IPv4 specific, it is not available
|
|
in ip6tables.
|
|
<DT id="34"><B>-c</B>, <B>--set-counters</B> <I>packets bytes</I><DD>
|
|
This enables the administrator to initialize the packet and byte
|
|
counters of a rule (during <B>INSERT</B>, <B>APPEND</B>, <B>REPLACE</B>
|
|
operations).
|
|
</DL>
|
|
<A NAME="lbAJ"> </A>
|
|
<H3>OTHER OPTIONS</H3>
|
|
|
|
The following additional options can be specified:
|
|
<DL COMPACT>
|
|
<DT id="35"><B>-v</B>, <B>--verbose</B><DD>
|
|
Verbose output. This option makes the list command show the interface
|
|
name, the rule options (if any), and the TOS masks. The packet and
|
|
byte counters are also listed, with the suffix 'K', 'M' or 'G' for
|
|
1000, 1,000,000 and 1,000,000,000 multipliers respectively (but see
|
|
the <B>-x</B> flag to change this).
|
|
For appending, insertion, deletion and replacement, this causes
|
|
detailed information on the rule or rules to be printed. <B>-v</B> may be
|
|
specified multiple times to possibly emit more detailed debug statements.
|
|
<DT id="36"><B>-w</B>, <B>--wait</B> [<I>seconds</I>]<DD>
|
|
Wait for the xtables lock.
|
|
To prevent multiple instances of the program from running concurrently,
|
|
an attempt will be made to obtain an exclusive lock at launch. By default,
|
|
the program will exit if the lock cannot be obtained. This option will
|
|
make the program wait (indefinitely or for optional <I>seconds</I>) until
|
|
the exclusive lock can be obtained.
|
|
<DT id="37"><B>-W</B>, <B>--wait-interval</B> <I>microseconds</I><DD>
|
|
Interval to wait per each iteration.
|
|
When running latency sensitive applications, waiting for the xtables lock
|
|
for extended durations may not be acceptable. This option will make each
|
|
iteration take the amount of time specified. The default interval is
|
|
1 second. This option only works with <B>-w</B>.
|
|
<DT id="38"><B>-n</B>, <B>--numeric</B><DD>
|
|
Numeric output.
|
|
IP addresses and port numbers will be printed in numeric format.
|
|
By default, the program will try to display them as host names,
|
|
network names, or services (whenever applicable).
|
|
<DT id="39"><B>-x</B>, <B>--exact</B><DD>
|
|
Expand numbers.
|
|
Display the exact value of the packet and byte counters,
|
|
instead of only the rounded number in K's (multiples of 1000)
|
|
M's (multiples of 1000K) or G's (multiples of 1000M). This option is
|
|
only relevant for the <B>-L</B> command.
|
|
<DT id="40"><B>--line-numbers</B><DD>
|
|
When listing rules, add line numbers to the beginning of each rule,
|
|
corresponding to that rule's position in the chain.
|
|
<DT id="41"><B>--modprobe=</B><I>command</I><DD>
|
|
When adding or inserting rules into a chain, use <I>command</I>
|
|
to load any necessary modules (targets, match extensions, etc).
|
|
</DL>
|
|
<A NAME="lbAK"> </A>
|
|
<H2>MATCH AND TARGET EXTENSIONS</H2>
|
|
|
|
<P>
|
|
|
|
iptables can use extended packet matching and target modules.
|
|
A list of these is available in the <B><A HREF="/cgi-bin/man/man2html?8+iptables-extensions">iptables-extensions</A></B>(8) manpage.
|
|
<A NAME="lbAL"> </A>
|
|
<H2>DIAGNOSTICS</H2>
|
|
|
|
Various error messages are printed to standard error. The exit code
|
|
is 0 for correct functioning. Errors which appear to be caused by
|
|
invalid or abused command line parameters cause an exit code of 2, and
|
|
other errors cause an exit code of 1.
|
|
<A NAME="lbAM"> </A>
|
|
<H2>BUGS</H2>
|
|
|
|
Bugs? What's this? ;-)
|
|
Well, you might want to have a look at <A HREF="http://bugzilla.netfilter.org/">http://bugzilla.netfilter.org/</A>
|
|
<A NAME="lbAN"> </A>
|
|
<H2>COMPATIBILITY WITH IPCHAINS</H2>
|
|
|
|
This <B>iptables</B>
|
|
is very similar to ipchains by Rusty Russell. The main difference is
|
|
that the chains <B>INPUT</B> and <B>OUTPUT</B>
|
|
are only traversed for packets coming into the local host and
|
|
originating from the local host respectively. Hence every packet only
|
|
passes through one of the three chains (except loopback traffic, which
|
|
involves both INPUT and OUTPUT chains); previously a forwarded packet
|
|
would pass through all three.
|
|
<P>
|
|
|
|
The other main difference is that <B>-i</B> refers to the input interface;
|
|
<B>-o</B> refers to the output interface, and both are available for packets
|
|
entering the <B>FORWARD</B> chain.
|
|
<P>
|
|
|
|
The various forms of NAT have been separated out; <B>iptables</B>
|
|
is a pure packet filter when using the default `filter' table, with
|
|
optional extension modules. This should simplify much of the previous
|
|
confusion over the combination of IP masquerading and packet filtering
|
|
seen previously. So the following options are handled differently:
|
|
<PRE>
|
|
-j MASQ
|
|
-M -S
|
|
-M -L
|
|
</PRE>
|
|
|
|
There are several other changes in iptables.
|
|
<A NAME="lbAO"> </A>
|
|
<H2>SEE ALSO</H2>
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?8+iptables-apply">iptables-apply</A></B>(8),
|
|
<B><A HREF="/cgi-bin/man/man2html?8+iptables-save">iptables-save</A></B>(8),
|
|
<B><A HREF="/cgi-bin/man/man2html?8+iptables-restore">iptables-restore</A></B>(8),
|
|
<B><A HREF="/cgi-bin/man/man2html?8+iptables-extensions">iptables-extensions</A></B>(8),
|
|
<P>
|
|
|
|
The packet-filtering-HOWTO details iptables usage for
|
|
packet filtering, the NAT-HOWTO details NAT,
|
|
the netfilter-extensions-HOWTO details the extensions that are
|
|
not in the standard distribution,
|
|
and the netfilter-hacking-HOWTO details the netfilter internals.
|
|
<BR>
|
|
|
|
See
|
|
<B><A HREF="http://www.netfilter.org/">http://www.netfilter.org/</A></B>.
|
|
|
|
<A NAME="lbAP"> </A>
|
|
<H2>AUTHORS</H2>
|
|
|
|
Rusty Russell originally wrote iptables, in early consultation with Michael
|
|
Neuling.
|
|
<P>
|
|
|
|
Marc Boucher made Rusty abandon ipnatctl by lobbying for a generic packet
|
|
selection framework in iptables, then wrote the mangle table, the owner match,
|
|
the mark stuff, and ran around doing cool stuff everywhere.
|
|
<P>
|
|
|
|
James Morris wrote the TOS target, and tos match.
|
|
<P>
|
|
|
|
Jozsef Kadlecsik wrote the REJECT target.
|
|
<P>
|
|
|
|
Harald Welte wrote the ULOG and NFQUEUE target, the new libiptc, as well as the TTL, DSCP, ECN matches and targets.
|
|
<P>
|
|
|
|
The Netfilter Core Team is: Jozsef Kadlecsik, Pablo Neira Ayuso,
|
|
Eric Leblond, Florian Westphal and Arturo Borrero Gonzalez.
|
|
Emeritus Core Team members are: Marc
|
|
Boucher, Martin Josefsson, Yasuyuki Kozakai, James Morris, Harald Welte and
|
|
Rusty Russell.
|
|
<P>
|
|
|
|
Man page originally written by Herve Eychenne <<A HREF="mailto:rv@wallfire.org">rv@wallfire.org</A>>.
|
|
|
|
|
|
|
|
|
|
<A NAME="lbAQ"> </A>
|
|
<H2>VERSION</H2>
|
|
|
|
<P>
|
|
|
|
This manual page applies to iptables/ip6tables 1.8.4.
|
|
<P>
|
|
|
|
<HR>
|
|
<A NAME="index"> </A><H2>Index</H2>
|
|
<DL>
|
|
<DT id="42"><A HREF="#lbAB">NAME</A><DD>
|
|
<DT id="43"><A HREF="#lbAC">SYNOPSIS</A><DD>
|
|
<DT id="44"><A HREF="#lbAD">DESCRIPTION</A><DD>
|
|
<DT id="45"><A HREF="#lbAE">TARGETS</A><DD>
|
|
<DT id="46"><A HREF="#lbAF">TABLES</A><DD>
|
|
<DT id="47"><A HREF="#lbAG">OPTIONS</A><DD>
|
|
<DL>
|
|
<DT id="48"><A HREF="#lbAH">COMMANDS</A><DD>
|
|
<DT id="49"><A HREF="#lbAI">PARAMETERS</A><DD>
|
|
<DT id="50"><A HREF="#lbAJ">OTHER OPTIONS</A><DD>
|
|
</DL>
|
|
<DT id="51"><A HREF="#lbAK">MATCH AND TARGET EXTENSIONS</A><DD>
|
|
<DT id="52"><A HREF="#lbAL">DIAGNOSTICS</A><DD>
|
|
<DT id="53"><A HREF="#lbAM">BUGS</A><DD>
|
|
<DT id="54"><A HREF="#lbAN">COMPATIBILITY WITH IPCHAINS</A><DD>
|
|
<DT id="55"><A HREF="#lbAO">SEE ALSO</A><DD>
|
|
<DT id="56"><A HREF="#lbAP">AUTHORS</A><DD>
|
|
<DT id="57"><A HREF="#lbAQ">VERSION</A><DD>
|
|
</DL>
|
|
<HR>
|
|
This document was created by
|
|
<A HREF="/cgi-bin/man/man2html">man2html</A>,
|
|
using the manual pages.<BR>
|
|
Time: 00:06:13 GMT, March 31, 2021
|
|
</BODY>
|
|
</HTML>
|