path: root/ip6tables.8
diff options
Diffstat (limited to 'ip6tables.8')
1 files changed, 32 insertions, 28 deletions
diff --git a/ip6tables.8 b/ip6tables.8
index afd2f9c..53a310c 100644
--- a/ip6tables.8
+++ b/ip6tables.8
@@ -27,7 +27,7 @@
ip6tables \- IPv6 packet filter administration
-.BR "ip6tables [-t table] -[ADC] " "chain rule-specification [options]"
+.BR "ip6tables [-t table] -[AD] " "chain rule-specification [options]"
.BR "ip6tables [-t table] -I " "chain [rulenum] rule-specification [options]"
@@ -93,8 +93,9 @@ loading, an attempt will be made to load the appropriate module for
that table if it is not already there.
The tables are as follows:
-.B "filter"
+.TP .4i
+.BR "filter" :
This is the default table (if no -t option is passed). It contains
the built-in chains
@@ -104,7 +105,7 @@ the built-in chains
(for locally-generated packets).
-.B "mangle"
+.BR "mangle" :
This table is used for specialized packet alteration. Until kernel
2.4.17 it had two built-in chains:
@@ -118,6 +119,7 @@ Since kernel 2.4.18, three other built-in chains are also supported:
(for altering packets being routed through the box), and
(for altering packets as they are about to go out).
The options that are recognized by
.B ip6tables
@@ -157,10 +159,10 @@ fail. Rules are numbered starting at 1.
.BR "-L, --list " "[\fIchain\fP]"
List all rules in the selected chain. If no chain is selected, all
chains are listed. As every other iptables command, it applies to the
-specified table (filter is the default), so NAT rules get listed by
- iptables -t nat -n -L
+specified table (filter is the default), so mangle rules get listed by
+ ip6tables -t mangle -n -L
Please note that it is often used with the
.B -n
option, in order to avoid long reverse DNS lookups.
@@ -169,9 +171,9 @@ It is legal to specify the
(zero) option as well, in which case the chain(s) will be atomically
listed and zeroed. The exact output is affected by the other
arguments given. The exact rules are suppressed until you use
ip6tables -L -v
.BR "-F, --flush " "[\fIchain\fP]"
Flush the selected chain (all the chains in the table if none is given).
@@ -398,14 +400,14 @@ the second argument is a comma-separated list of flags which must be
set. Flags are:
Hence the command
ip6tables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST SYN
will only match packets with the SYN flag set, and the ACK, FIN and
RST flags unset.
.B "[!] --syn"
-Only match TCP packets with the SYN bit set and the ACK and FIN bits
+Only match TCP packets with the SYN bit set and the ACK and RST bits
cleared. Such packets are used to request TCP connection initiation;
for example, blocking such packets coming in an interface will prevent
incoming TCP connections, but outgoing TCP connections will be
@@ -438,9 +440,9 @@ specified. It provides the following option:
.BR "--icmpv6-type " "[!] \fItypename\fP"
This allows specification of the ICMP type, which can be a numeric
IPv6-ICMP type, or one of the IPv6-ICMP type names shown by the command
ip6tables -p ipv6-icmp -h
.SS mac
.BR "--mac-source " "[!] \fIaddress\fP"
@@ -607,15 +609,17 @@ chains. The following option controls the nature of the error packet
.BI "--reject-with " "type"
-The type given can be
-.BR icmp6-no-route ,
-.BR no-route ,
-.BR icmp6-adm-prohibited ,
-.BR adm-prohibited ,
-.BR icmp6-addr-unreachable ,
-.BR addr-unreach ,
-.BR icmp6-port-unreachable ,
-.BR port-unreach ,
+The type given can be
+.B " icmp6-no-route"
+.B " no-route"
+.B " icmp6-adm-prohibited"
+.B " adm-prohibited"
+.B " icmp6-addr-unreachable"
+.B " addr-unreach"
+.B " icmp6-port-unreachable"
+.B " port-unreach"
which return the appropriate IPv6-ICMP error message (\fBport-unreach\fP is
the default). Finally, the option
.B tcp-reset
@@ -751,7 +755,8 @@ and
are only traversed for packets coming into the local host and
originating from the local host respectively. Hence every packet only
-passes through one of the three chains; previously a forwarded packet
+passes through one of the three chains (except loopback traffic, which
+involves both INPUT and OUTPUT chains); previously a forwarded packet
would pass through all three.
The other main difference is that
@@ -805,12 +810,11 @@ Jozsef Kadlecsik wrote the REJECT target.
Harald Welte wrote the ULOG target, TTL match+target and libipulog.
-The Netfilter Core Team is: Marc Boucher, Jozsef Kadlecsik, James Morris,
-Harald Welte and Rusty Russell.
+The Netfilter Core Team is: Marc Boucher, Martin Josefsson, Jozsef Kadlecsik,
+James Morris, Harald Welte and Rusty Russell.
ip6tables man page created by Andras Kis-Szabo, based on
iptables man page written by Herve Eychenne <>.
.\" .. and did I mention that we are incredibly cool people?
.\" .. sexy, too ..
.\" .. witty, charming, powerful ..