Manpage of IPTABLES
-N, --new-chain chain
Create a new user-defined chain by the given name. There must be no target of that name already.
-X, --delete-chain [chain]
Delete the optional user-defined chain specified. There must be no references to the chain. If there
are, you must delete or replace the referring rules before the chain can be deleted. If no argument
is given, it will attempt to delete every non-builtin chain in the table.
-P, --policy chain target
Set the policy for the chain to the given target. See the section TARGETS for the legal targets.
Only built-in (non-user-defined) chains can have policies, and neither built-in nor user-defined
chains can be policy targets.
-E, --rename-chain old-chain new-chain
Rename the user specified chain to the user supplied name. This is cosmetic, and has no effect on
the structure of the table.
-h
Help. Give a (currently very brief) description of the command syntax.
PARAMETERS
The following parameters make up a rule specification (as used in the add, delete, insert, replace and
append commands).
-p, --protocol [!] protocol
The protocol of the rule or of the packet to check. The specified protocol can be one of tcp, udp,
icmp, or all, or it can be a numeric value, representing one of these protocols or a different one. A
protocol name from /etc/protocols is also allowed. A "!" argument before the protocol inverts the
test. The number zero is equivalent to all. Protocol all will match with all protocols and is taken as
default when this option is omitted.
-s, --source [!] address[/mask]
Source specification. Address can be either a network name, a hostname (please note that
specifying any name to be resolved with a remote query such as DNS is a really bad idea), a
network IP address (with /mask), or a plain IP address. The mask can be either a network mask or
a plain number, specifying the number of 1's at the left side of the network mask. Thus, a mask of
24 is equivalent to 255.255.255.0. A "!" argument before the address specification inverts the
sense of the address. The flag --src is an alias for this option.
-d, --destination [!] address[/mask]
Destination specification. See the description of the -s (source) flag for a detailed description of
the syntax. The flag --dst is an alias for this option.
-j, --jump target
This specifies the target of the rule; i.e., what to do if the packet matches it. The target can be a
user-defined chain (other than the one this rule is in), one of the special builtin targets which
decide the fate of the packet immediately, or an extension (see EXTENSIONS below). If this
http://www.iptablesrocks.org/syntax/man_iptables.htm (4 of 20) [2/13/2004 8:04:51 PM]
