Manpage of IPTABLES
OPTIONS
The options that are recognized by iptables can be divided into several different groups.
COMMANDS
These options specify the specific action to perform. Only one of them can be specified on the command
line unless otherwise specified below. For all the long versions of the command and option names, you
need to use only enough letters to ensure that iptables can differentiate it from all other options.
-A, --append chain rule-specification
Append one or more rules to the end of the selected chain. When the source and/or destination
names resolve to more than one address, a rule will be added for each possible address
combination.
-D, --delete chain rule-specification
-D, --delete chain rulenum
Delete one or more rules from the selected chain. There are two versions of this command: the rule
can be specified as a number in the chain (starting at 1 for the first rule) or a rule to match.
-I, --insert chain [rulenum] rule-specification
Insert one or more rules in the selected chain as the given rule number. So, if the rule number is 1,
the rule or rules are inserted at the head of the chain. This is also the default if no rule number is
specified.
-R, --replace chain rulenum rule-specification
Replace a rule in the selected chain. If the source and/or destination names resolve to multiple
addresses, the command will fail. Rules are numbered starting at 1.
-L, --list [chain]
List all rules in the selected chain. If no chain is selected, all chains are listed. As every other
iptables command, it applies to the specified table (filter is the default), so NAT rules get listed by
iptables -t nat -n -L
Please note that it is often used with the -n option, in order to avoid long reverse DNS lookups. It
is legal to specify the -Z (zero) option as well, in which case the chain(s) will be atomically listed
and zeroed. The exact output is affected by the other arguments given. The exact rules are
suppressed until you use
iptables -L -v
-F, --flush [chain]
Flush the selected chain (all the chains in the table if none is given). This is equivalent to deleting
all the rules one by one.
-Z, --zero [chain]
Zero the packet and byte counters in all chains. It is legal to specify the -L, --list (list) option as
well, to see the counters immediately before they are cleared. (See above.)
http://www.iptablesrocks.org/syntax/man_iptables.htm (3 of 20) [2/13/2004 8:04:51 PM]
