Cyclades AlterPath ACS, Справочник по командам

Страница: 141 / 420

AlterPath ACS Command Reference Guide
125
Network
-j - - jump target
This specifies the target of the rule; i.e., what to do if the packet matches it.
The target can be a user-defined chain (other than the one this rule is in), one
of the special built-in targets which decide the fate of the packet immediately,
or an extension (see EXTENSIONS below). If this option is omitted in a rule,
then matching the rule will have no effect on the packet's fate, but the counters
on the rule is incremental. The special built-in targets are :
•
ACCEPT means to let the packet through.
•
DROP means to drop the packet on the floor.
•
QUEUE means to pass the packet to userspace (if supported by the
kernel).
•
RETURN means stop traversing this chain and resume at the next rule
in the previous (calling) chain. If the end of a built-in chain is reached or
a rule in a built-in chain with target RETURN is matched, the target
specified by the chain policy determines the fate of the packet.
-i - -in-interface[!][name]
Optional name of an interface via which a packet is received (for packets
entering the INPUT and FORWARD chains). When the "!" argument is used
before the interface name, the sense is inverted. If the interface name ends in a
"+" then any interface which begins with this name will match. If this option is
omitted, the string "+" is assumed, which will match with any interface name.
-o - -out-interface[!][name]
Optional name of an interface via which a packet is going to be sent (for
packets entering the FORWARD and OUTPUT chains). When the "!"
argument is used before the interface name, the sense is inverted. If the
interface name ends in a "+" then any interface which begins with this name
will match. If this option is omitted, the string "+" is assumed, which will
match with any interface name.
[!] -f - -fragment
This means that the rule only refers to second and further fragments of
fragmented packets. Since there is no way to tell the source or destination
ports of such a packet (or ICMP type), such a packet will not match any rules
which specify them. When the "!" argument precedes the "-f" flag, the rule
will only match head fragments, or unfragmented packets.
-c - -set-counters PKTS BYTES
This enables the administrater to initialize the packet and byte counters of a
rule (during INSERT, APPEND, REPLACE operations).
Parameter Description
Table 4.4: iptables rules specifications