path: root/extensions/
diff options
authorKOVACS Krisztian <>2008-10-15 11:49:37 +0200
committerPatrick McHardy <>2008-10-15 11:49:37 +0200
commit92b54aa2b436387f85783d3f420ccaa12fdaf891 (patch)
tree45683043520032beb531b46d78360f24d0ab73e5 /extensions/
parent93086d4b51ee17e8fa4b5b0261a0f76d32fe71d8 (diff)
Add iptables support for the TPROXY target
Signed-off-by: KOVACS Krisztian <> Signed-off-by: Patrick McHardy <>
Diffstat (limited to 'extensions/')
1 files changed, 21 insertions, 0 deletions
diff --git a/extensions/ b/extensions/
new file mode 100644
index 00000000..f17848c4
--- /dev/null
+++ b/extensions/
@@ -0,0 +1,21 @@
+This target is only valid in the \fBmangle\fR table, in the \fBPREROUTING\fR
+chain and user-defined chains which are only called from this chain. It
+redirects the packet to a local socket without changing the packet header in
+any way. It can also change the mark value which can then be used in advanced
+routing rules.
+It takes three options:
+\fB--on-port\fR \fIport\fR
+This specifies a destination port to use. It is a required option, 0 means the
+new destination port is the same as the original. This is only valid if the
+rule also specifies \fB-p tcp\fR or \fB-p udp\fR.
+\fB--on-ip\fR \fIaddress\fR
+This specifies a destination address to use. By default the address is the IP
+address of the incoming interface. This is only valid if the rule also
+specifies \fB-p tcp\fR or \fR-p udp\fR.
+\fB--tproxy-mark\fR \fIvalue\fR[\fB/\fR\fImask\fR]
+Marks packets with the given value/mask. The fwmark value set here can be used
+by advanced routing. (Required for transparent proxying to work: otherwise
+these packets will get forwarded, which is probably not what you want.)