Append new rules to chain.

Delete rules from chain. Rules can be specified by their ordinal number in the chain as well as by a general rule description.

Rename old-chain to new-chain.

Remove all rules from chain, or from all chains if chain is not specified.

Insert rules into chain at the ordinal position given by number.

List the rules in chain, or all chains if chain is not specified.

Create a new chain. The chain's name must be unique. This is how user-defined chains are created.

Set the default policy for a built-in chain; the target itself cannot be a chain.

Replace a rule in chain. The rule to be replaced is specified by its ordinal number.

Delete the specified user-defined chain, or all user-defined chains if chain is not specified.

Zero the packet and byte counters in chain. If no chain is specified, all chains will be reset. When used without specifying a chain and combined with the -L command, list the current counter values before they are reset.

Let the packet through.

Drop the packet.

Send packets to the user space for processing.

Stop traversing the current chain and return to the point in the previous chain from which this one was called. If RETURN is the target of a rule in a built-in chain, the built-in chain's default policy is applied.

Initialize packet and byte counters to the specified values.

Match packets from the destination address. The address may be supplied as a hostname, a network name, or an IP address. The optional mask is the netmask to use and may be supplied either in the traditional form (e.g., /255.255.255.0) or in the modern form (e.g., /24).

The rule applies only to the second or further fragments of a fragmented packet.

Match packets being received from interface name. name is the network interface used by your system (e.g., eth0 or ppp0). A + can be used as a wildcard, so ppp+would match any interface name beginning with ppp.

Jump to a special target or a user-defined chain. If this option is not specified for a rule, matching the rule only increases the rule's counters, and the packet is tested against the next rule.

Match packets being sent from interface name. See the description of -i for the syntax for name.

Match packets of protocol name. The value of name can be given as a name or number, as found in the file /etc/protocols. The most common values are tcp, udp,icmp, or the special value all. The number 0 is equivalent to all, and this is the default value when this option is not used. If there are extended matching rules associated with the specified protocol, they will be loaded automatically. You need not use the -m option to load them.

Match packets with the source address. See the description of -d for the syntax of this option.

Print help message. If icmp is specified, a list of valid ICMP type names will be printed.-h can also be used with the -m option to get help on an extension module.

Used with the -L command. Add the line number to the beginning of each rule in a listing, indicating its position in the chain.

Explicitly load matching rule extensions associated with module. See the next section.

Use specified command to load any necessary kernel modules while adding or inserting rules into a chain.

Print all IP address and port numbers in numeric form. By default, text names are displayed when possible.

Apply rules to the specified table. Rules apply to the filter table by default.

Verbose mode.

Expand all numbers in a listing (-L). Display the exact value of the packet and byte counters instead of rounded figures.

Loaded when -p icmp is the only protocol specified:

--icmp-type [!] type

Match the specified ICMP type. type may be a numeric ICMP type or one of the ICMP type names shown by the command iptables -p icmp -h.

Loaded explicitly with the -m option. The multiport extensions match sets of source or destination ports. These rules can be used only in conjunction with -p tcp and -p udp. Up to 15 ports can be specified in a comma-separated list:

--source-port [ports]

Match the given source ports.

--destination-port [ports]

Match the given destination ports.

--port [ports]

Match if the packet has the same source and destination port and that port is one of the given ports.

Loaded explicitly with the -m option. This module matches the connection state of a packet:

--state states

Match the packet if it has one of the states in the comma-separated liststates. Valid states are INVALID, ESTABLISHED, NEW, and RELATED.

Loaded when -p tcp is the only protocol specified:

--source-port [!] [port] [:port] , --sport [!] [port] [:port]

Match the specified source ports. Using the colon specifies an inclusive range of services to match. If the first port is omitted, 0 is the default. If the second port is omitted, 65535 is the default. You can also use a dash instead of a colon to specify the range.

--destination-port [!] [port] [:port] , --dport [!] [port] [:port]

Match the specified destination ports. The syntax is the same as for --source-port.

--mss n[:n]

Match if TCP SYN or SYN/ACK packets have the specified MSS value or fall within the specified range. Use this to control the maximum packet size for a connection.

[!] --syn

Match packets with the SYN bit set and the ACK and FIN bits cleared. These are packets that request TCP connections; blocking them prevents incoming connections. Shorthand for --tcp-flags SYN,RST,ACK SYN.

--tcp-flags [!] mask comp

Match the packets with the TCP flags specified by mask and comp. maskis a comma-separated list of flags that should be examined. comp is a comma-separated list of flags that must be set for the rule to match. Valid flags are SYN, ACK, FIN, RST, URG, PSH, ALL, and NONE.

--tcp-option [!] n

Match if TCP option is set.

Loaded when -p udp is the only protocol specified:

--source-port [!] [port] [:port] , --sport [!] [port] [:port]

Match the specified source ports. The syntax is the same as for the --source-port option of the TCP extension.

--destination-port [!] [port] [:port] , --dport [!] [port] [:port]

Match the specified destination ports. The syntax is the same as for the --source-port option of the TCP extension.

Modify the destination address of the packet and all future packets in the current connection. DNAT is valid only as a part of the POSTROUTING chain in the nat table:

--to-destination address[-address] [port-port]

Specify the new destination address or range of addresses. The arguments for this option are the same as the --to-source argument for the SNAT extension target.

Log the packet's information in the system log:

--log-level level

Set the syslog level by name or number (as defined by syslog.conf).

--log-prefix prefix

Begin each log entry with the string prefix. The prefix string may be up to 30 characters long.

--log-tcp-sequence

Log the TCP sequence numbers. This is a security risk if your log is readable by users.

--log-tcp-options

Log options from the TCP packet header.

--log-ip-options

Log options from the IP packet header.

Masquerade the packet so it appears that it originated from the current system. Reverse packets from masqueraded connections are unmasqueraded automatically. This is a legal target only for chains in the nat table that handle incoming packets and should be used only with dynamic IP addresses (like dial-up.) For static addresses useDNAT:

--to-ports port[-port]

Specify the port or range of ports to use when masquerading. This option is valid only if a tcp or udp protocol has been specified with the -p option. If this option is not used, the masqueraded packet's port will not be changed.

Drop the packet and, if appropriate, send an ICMP message back to the sender indicating the packet was dropped. If the packet was an ICMP error message, an unknown ICMP type, or a nonhead fragment, or if too many ICMP messages have already been sent to this address, no message is sent:

--reject-with type

Send specified ICMP message type. Valid values are icmp-net-unreachable, icmp-host-unreachable, icmp-port-unreachable, or icmp-proto-unreachable. If the packet was an ICMP ping packet, type may also be echo-reply.

Modify the source address of the packet and all future packets in the current connection. SNAT is valid only as a part of the POSTROUTING chain in the nat table:

--to-source address[-address] [port-port]

Specify the new source address or range of addresses. If a tcp or udpprotocol has been specified with the -p option, source ports may also be specified. If none is specified, map the new source to the same port if possible. If not, map ports below 512 to other ports below 512, those between 512 and 1024 to other ports below 1024, and ports above 1024 to other ports above 1024.