Manpage of IPTABLES
position in the chain.
--modprobe=command
When adding or inserting rules into a chain, use command to load any necessary modules (targets,
match extensions, etc).
MATCH EXTENSIONS
iptables can use extended packet matching modules. These are loaded in two ways: implicitly, when -p or
--protocol is specified, or with the -m or --match options, followed by the matching module name; after
these, various extra command line options become available, depending on the specific module. You can
specify multiple extended match modules in one line, and you can use the -h or --help options after the
module has been specified to receive help specific to that module.
The following are included in the base package, and most of these can be preceded by a ! to invert the
sense of the match.
tcp
These extensions are loaded if `--protocol tcp' is specified. It provides the following options:
--source-port [!] port[:port]
Source port or port range specification. This can either be a service name or a port number. An
inclusive range can also be specified, using the format port:port. If the first port is omitted, "0" is
assumed; if the last is omitted, "65535" is assumed. If the second port greater then the first they
will be swapped. The flag --sport is a convenient alias for this option.
--destination-port [!] port[:port]
Destination port or port range specification. The flag --dport is a convenient alias for this option.
--tcp-flags [!] mask comp
Match when the TCP flags are as specified. The first argument is the flags which we should
examine, written as a comma-separated list, and the second argument is a comma-separated list of
flags which must be set. Flags are: SYN ACK FIN RST URG PSH ALL NONE. Hence the
command
iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST SYN
will only match packets with the SYN flag set, and the ACK, FIN and RST flags unset.
[!] --syn
Only match TCP packets with the SYN bit set and the ACK and FIN bits cleared. Such packets are
used to request TCP connection initiation; for example, blocking such packets coming in an
interface will prevent incoming TCP connections, but outgoing TCP connections will be
unaffected. It is equivalent to --tcp-flags SYN,RST,ACK SYN. If the "!" flag precedes the "--
http://www.iptablesrocks.org/syntax/man_iptables.htm (6 of 20) [2/13/2004 8:04:51 PM]
