Manpage of IPTABLES
option is omitted in a rule, then matching the rule will have no effect on the packet's fate, but the
counters on the rule will be incremented.
-i, --in-interface [!] name
Name of an interface via which a packet is going to be received (only for packets entering the
INPUT, FORWARD and PREROUTING chains). When the "!" argument is used before the
interface name, the sense is inverted. If the interface name ends in a "+", then any interface which
begins with this name will match. If this option is omitted, any interface name will match.
-o, --out-interface [!] name
Name of an interface via which a packet is going to be sent (for packets entering the FORWARD,
OUTPUT and POSTROUTING chains). When the "!" argument is used before the interface
name, the sense is inverted. If the interface name ends in a "+", then any interface which begins
with this name will match. If this option is omitted, any interface name will match.
[!] -f, --fragment
This means that the rule only refers to second and further fragments of fragmented packets. Since
there is no way to tell the source or destination ports of such a packet (or ICMP type), such a
packet will not match any rules which specify them. When the "!" argument precedes the "-f" flag,
the rule will only match head fragments, or unfragmented packets.
-c, --set-counters PKTS BYTES
This enables the administrator to initialize the packet and byte counters of a rule (during INSERT,
APPEND, REPLACE operations).
OTHER OPTIONS
The following additional options can be specified:
-v, --verbose
Verbose output. This option makes the list command show the interface name, the rule options (if
any), and the TOS masks. The packet and byte counters are also listed, with the suffix 'K', 'M' or
'G' for 1000, 1,000,000 and 1,000,000,000 multipliers respectively (but see the -x flag to change
this). For appending, insertion, deletion and replacement, this causes detailed information on the
rule or rules to be printed.
-n, --numeric
Numeric output. IP addresses and port numbers will be printed in numeric format. By default, the
program will try to display them as host names, network names, or services (whenever applicable).
-x, --exact
Expand numbers. Display the exact value of the packet and byte counters, instead of only the
rounded number in K's (multiples of 1000) M's (multiples of 1000K) or G's (multiples of 1000M).
This option is only relevant for the -L command.
--line-numbers
When listing rules, add line numbers to the beginning of each rule, corresponding to that rule's
http://www.iptablesrocks.org/syntax/man_iptables.htm (5 of 20) [2/13/2004 8:04:51 PM]
