path: root/extensions/
diff options
author/C=EU/ST=EU/CN=Patrick McHardy/ </C=EU/ST=EU/CN=Patrick McHardy/>2008-04-14 07:09:49 +0000
committer/C=EU/ST=EU/CN=Patrick McHardy/ </C=EU/ST=EU/CN=Patrick McHardy/>2008-04-14 07:09:49 +0000
commit727e8f40cd9196c9a617d37a96bc1deba610caac (patch)
tree74521e49f0274dd0ff7831d9b71d25ef020820b5 /extensions/
parent5bc09b8e9db045c7136d76405c1733ea531be0f7 (diff)
[PATCH 5/8] Combine ipt and ip6t manpages
Combine ipt and ip6t manpages
Diffstat (limited to 'extensions/')
1 files changed, 45 insertions, 0 deletions
diff --git a/extensions/ b/extensions/
new file mode 100644
index 0000000..cfafc9e
--- /dev/null
+++ b/extensions/
@@ -0,0 +1,45 @@
+These extensions can be used if `--protocol tcp' is specified. It
+provides the following options:
+.BR "--source-port " "[!] \fIport\fP[:\fIport\fP]"
+Source port or port range specification. This can either be a service
+name or a port number. An inclusive range can also be specified,
+using the format
+.IR port : port .
+If the first port is omitted, "0" is assumed; if the last is omitted,
+"65535" is assumed.
+If the second port greater then the first they will be swapped.
+The flag
+.B --sport
+is a convenient alias for this option.
+.BR "--destination-port " "[!] \fIport\fP[:\fIport\fP]"
+Destination port or port range specification. The flag
+.B --dport
+is a convenient alias for this option.
+.BR "--tcp-flags " "[!] \fImask\fP \fIcomp\fP"
+Match when the TCP flags are as specified. The first argument is the
+flags which we should examine, written as a comma-separated list, and
+the second argument is a comma-separated list of flags which must be
+set. Flags are:
+Hence the command
+ iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST SYN
+will only match packets with the SYN flag set, and the ACK, FIN and
+RST flags unset.
+.B "[!] --syn"
+Only match TCP packets with the SYN bit set and the ACK,RST and FIN bits
+cleared. Such packets are used to request TCP connection initiation;
+for example, blocking such packets coming in an interface will prevent
+incoming TCP connections, but outgoing TCP connections will be
+It is equivalent to \fB--tcp-flags SYN,RST,ACK,FIN SYN\fP.
+If the "!" flag precedes the "--syn", the sense of the
+option is inverted.
+.BR "--tcp-option " "[!] \fInumber\fP"
+Match if TCP option set.