Manpage of IPTABLES
--log-tcp-options
Log options from the TCP packet header.
--log-ip-options
Log options from the IP packet header.
MARK
This is used to set the netfilter mark value associated with the packet. It is only valid in the mangle table.
It can for example be used in conjunction with iproute2.
--set-mark mark
REJECT
This is used to send back an error packet in response to the matched packet: otherwise it is equivalent to
DROP so it is a terminating TARGET, ending rule traversal. This target is only valid in the INPUT,
FORWARD and OUTPUT chains, and user-defined chains which are only called from those chains. The
following option controls the nature of the error packet returned:
--reject-with type
The type given can be icmp-net-unreachable, icmp-host-unreachable, icmp-port-unreachable,
icmp-proto-unreachable, icmp-net-prohibited or icmp-host-prohibited, which return the
appropriate ICMP error message (port-unreachable is the default). The option tcp-reset can be
used on rules which only match the TCP protocol: this causes a TCP RST packet to be sent back.
This is mainly useful for blocking ident (113/tcp) probes which frequently occur when sending
mail to broken mail hosts (which won't accept your mail otherwise).
TOS
This is used to set the 8-bit Type of Service field in the IP header. It is only valid in the mangle table.
--set-tos tos
You can use a numeric TOS values, or use
iptables -j TOS -h
http://www.iptablesrocks.org/syntax/man_iptables.htm (13 of 20) [2/13/2004 8:04:51 PM]
