summaryrefslogtreecommitdiffstats
path: root/extensions
diff options
context:
space:
mode:
Diffstat (limited to 'extensions')
-rw-r--r--extensions/Makefile75
-rw-r--r--extensions/libip6t_HL.man17
-rw-r--r--extensions/libip6t_LOG.man28
-rw-r--r--extensions/libip6t_MARK.man6
-rw-r--r--extensions/libip6t_REJECT.man34
-rw-r--r--extensions/libip6t_ROUTE.man12
-rw-r--r--extensions/libip6t_TRACE.man3
-rw-r--r--extensions/libip6t_ah.man3
-rw-r--r--extensions/libip6t_condition.man4
-rw-r--r--extensions/libip6t_dst.man7
-rw-r--r--extensions/libip6t_esp.man3
-rw-r--r--extensions/libip6t_eui64.man1
-rw-r--r--extensions/libip6t_frag.man19
-rw-r--r--extensions/libip6t_fuzzy.man7
-rw-r--r--extensions/libip6t_hbh.man7
-rw-r--r--extensions/libip6t_hl.man10
-rw-r--r--extensions/libip6t_icmpv6.man9
-rw-r--r--extensions/libip6t_ipv6header.man10
-rw-r--r--extensions/libip6t_length.man4
-rw-r--r--extensions/libip6t_limit.man15
-rw-r--r--extensions/libip6t_mac.man10
-rw-r--r--extensions/libip6t_mark.man9
-rw-r--r--extensions/libip6t_multiport.man19
-rw-r--r--extensions/libip6t_nth.man14
-rw-r--r--extensions/libip6t_owner.man21
-rw-r--r--extensions/libip6t_random.man4
-rw-r--r--extensions/libip6t_rt.man19
-rw-r--r--extensions/libip6t_tcp.man45
-rw-r--r--extensions/libip6t_udp.man14
-rw-r--r--extensions/libipt_BALANCE.man4
-rw-r--r--extensions/libipt_CLASSIFY.man4
-rw-r--r--extensions/libipt_CLUSTERIP.man24
-rw-r--r--extensions/libipt_CONNMARK.man13
-rw-r--r--extensions/libipt_DNAT.man27
-rw-r--r--extensions/libipt_DSCP.man9
-rw-r--r--extensions/libipt_ECN.man7
-rw-r--r--extensions/libipt_LOG.man28
-rw-r--r--extensions/libipt_MARK.man6
-rw-r--r--extensions/libipt_MASQUERADE.man22
-rw-r--r--extensions/libipt_MIRROR.man12
-rw-r--r--extensions/libipt_NETMAP.man9
-rw-r--r--extensions/libipt_NOTRACK.man5
-rw-r--r--extensions/libipt_REDIRECT.man18
-rw-r--r--extensions/libipt_REJECT.man34
-rw-r--r--extensions/libipt_ROUTE.man15
-rw-r--r--extensions/libipt_SNAT.man26
-rw-r--r--extensions/libipt_TCPMSS.man38
-rw-r--r--extensions/libipt_TOS.man11
-rw-r--r--extensions/libipt_TRACE.man3
-rw-r--r--extensions/libipt_TTL.man19
-rw-r--r--extensions/libipt_ULOG.man27
-rw-r--r--extensions/libipt_addrtype.man37
-rw-r--r--extensions/libipt_ah.man3
-rw-r--r--extensions/libipt_condition.man4
-rw-r--r--extensions/libipt_conntrack.man49
-rw-r--r--extensions/libipt_dscp.man10
-rw-r--r--extensions/libipt_dstlimit.man35
-rw-r--r--extensions/libipt_ecn.man11
-rw-r--r--extensions/libipt_esp.man3
-rw-r--r--extensions/libipt_fuzzy.man7
-rw-r--r--extensions/libipt_helper.man11
-rw-r--r--extensions/libipt_icmp.man9
-rw-r--r--extensions/libipt_iprange.man7
-rw-r--r--extensions/libipt_length.man4
-rw-r--r--extensions/libipt_limit.man15
-rw-r--r--extensions/libipt_mac.man10
-rw-r--r--extensions/libipt_mark.man9
-rw-r--r--extensions/libipt_mport.man19
-rw-r--r--extensions/libipt_multiport.man19
-rw-r--r--extensions/libipt_nth.man14
-rw-r--r--extensions/libipt_owner.man26
-rw-r--r--extensions/libipt_physdev.man42
-rw-r--r--extensions/libipt_pkttype.man3
-rw-r--r--extensions/libipt_random.man4
-rw-r--r--extensions/libipt_realm.man5
-rw-r--r--extensions/libipt_state.man21
-rw-r--r--extensions/libipt_tcp.man49
-rw-r--r--extensions/libipt_tcpmss.man4
-rw-r--r--extensions/libipt_time.man10
-rw-r--r--extensions/libipt_tos.man9
-rw-r--r--extensions/libipt_ttl.man10
-rw-r--r--extensions/libipt_udp.man14
-rw-r--r--extensions/libipt_unclean.man2
83 files changed, 1265 insertions, 0 deletions
diff --git a/extensions/Makefile b/extensions/Makefile
index db9d6041..2a45ea02 100644
--- a/extensions/Makefile
+++ b/extensions/Makefile
@@ -12,6 +12,29 @@ PF6_EXT_SLIB:=eui64 hl icmpv6 length limit mac mark multiport owner standard tcp
PF_EXT_SLIB_OPTS:=$(foreach T,$(wildcard extensions/.*-test),$(shell KERNEL_DIR=$(KERNEL_DIR) $(T)))
PF6_EXT_SLIB_OPTS:=$(foreach T,$(wildcard extensions/.*-test6),$(shell KERNEL_DIR=$(KERNEL_DIR) $(T)))
+PF_EXT_ALL_SLIB:=$(patsubst extensions/libipt_%.c, %, $(wildcard extensions/libipt_*.c))
+PF6_EXT_ALL_SLIB:=$(patsubst extensions/libip6t_%.c, %, $(wildcard extensions/libipt_*.c))
+
+PF_EXT_MAN_ALL_MATCHES:=$(foreach T,$(PF_EXT_ALL_SLIB),$(shell test -f extensions/libipt_$(T).man && grep -q register_match extensions/libipt_$(T).c && echo $(T)))
+PF_EXT_MAN_ALL_TARGETS:=$(foreach T,$(PF_EXT_ALL_SLIB),$(shell test -f extensions/libipt_$(T).man && grep -q register_target extensions/libipt_$(T).c && echo $(T)))
+PF6_EXT_MAN_ALL_MATCHES:=$(foreach T,$(PF6_EXT_ALL_SLIB),$(shell test -f extensions/libip6t_$(T).man && grep -q register_match6 extensions/libip6t_$(T).c && echo $(T)))
+PF6_EXT_MAN_ALL_TARGETS:=$(foreach T,$(PF6_EXT_ALL_SLIB),$(shell test -f extensions/libip6t_$(T).man && grep -q register_target6 extensions/libip6t_$(T).c && echo $(T)))
+
+PF_EXT_MAN_MATCHES:=$(filter $(PF_EXT_ALL_SLIB), $(PF_EXT_MAN_ALL_MATCHES))
+PF_EXT_MAN_TARGETS:=$(filter $(PF_EXT_ALL_SLIB), $(PF_EXT_MAN_ALL_TARGETS))
+PF_EXT_MAN_EXTRA_MATCHES:=$(filter-out $(PF_EXT_MAN_MATCHES), $(PF_EXT_MAN_ALL_MATCHES))
+PF_EXT_MAN_EXTRA_TARGETS:=$(filter-out $(PF_EXT_MAN_TARGETS), $(PF_EXT_MAN_ALL_TARGETS))
+PF6_EXT_MAN_MATCHES:=$(filter $(PF6_EXT_ALL_SLIB), $(PF6_EXT_MAN_ALL_MATCHES))
+PF6_EXT_MAN_TARGETS:=$(filter $(PF6_EXT_ALL_SLIB), $(PF6_EXT_MAN_ALL_TARGETS))
+PF6_EXT_MAN_EXTRA_MATCHES:=$(filter-out $(PF6_EXT_MAN_MATCHES), $(PF6_EXT_MAN_ALL_MATCHES))
+PF6_EXT_MAN_EXTRA_TARGETS:=$(filter-out $(PF6_EXT_MAN_TARGETS), $(PF6_EXT_MAN_ALL_TARGETS))
+
+
+allman:
+ @echo ALL_SLIB: $(PF_EXT_ALL_SLIB)
+ @echo ALL_MATCH: $(PF_EXT_MAN_ALL_MATCHES)
+ @echo ALL_TARGET: $(PF_EXT_MAN_ALL_TARGETS)
+
PF_EXT_SLIB+=$(PF_EXT_SLIB_OPTS)
PF6_EXT_SLIB+=$(PF6_EXT_SLIB_OPTS)
@@ -79,6 +102,58 @@ extensions/lib%.o: extensions/lib%.c
endif
+EXTRAS += extensions/libipt_targets.man
+extensions/libipt_targets.man: $(patsubst %,extensions/libipt_%.man,$(PF_EXT_MAN_ALL_TARGETS))
+ @for ext in $(PF_EXT_MAN_TARGETS); do \
+ echo ".SS $$ext" ;\
+ cat extensions/libipt_$$ext.man ;\
+ done >extensions/libipt_targets.man
+ @if [ -n "$(PF_EXT_MAN_EXTRA_TARGETS)" ]; then \
+ for ext in $(PF_EXT_MAN_EXTRA_TARGETS); do \
+ echo ".SS $$ext (not supported, see Patch-O-Matic)" ;\
+ cat extensions/libipt_$$ext.man ;\
+ done ;\
+ fi >>extensions/libipt_targets.man
+
+EXTRAS += extensions/libipt_matches.man
+extensions/libipt_matches.man: $(patsubst %,extensions/libipt_%.man,$(PF_EXT_MAN_ALL_MATCHES))
+ @for ext in $(PF_EXT_MAN_MATCHES); do \
+ echo ".SS $$ext" ;\
+ cat extensions/libipt_$$ext.man ;\
+ done >extensions/libipt_matches.man
+ @if [ -n "$(PF_EXT_MAN_EXTRA_MATCHES)" ]; then \
+ for ext in $(PF_EXT_MAN_EXTRA_MATCHES); do \
+ echo ".SS $$ext (not supported, see Patch-O-Matic)" ;\
+ cat extensions/libipt_$$ext.man ;\
+ done ;\
+ fi >>extensions/libipt_matches.man
+
+EXTRAS += extensions/libip6t_targets.man
+extensions/libip6t_targets.man: $(patsubst %, extensions/libip6t_%.man, $(PF6_EXT_MAN_ALL_TARGETS))
+ @for ext in $(PF6_EXT_MAN_TARGETS); do \
+ echo ".SS $$ext" ;\
+ cat extensions/libip6t_$$ext.man ;\
+ done >extensions/libip6t_targets.man
+ @if [ -n "$(PF6_EXT_MAN_EXTRA_TARGETS)" ]; then \
+ for ext in $(PF6_EXT_MAN_EXTRA_TARGETS); do \
+ echo ".SS $$ext (not supported, see Patch-O-Matic)" ;\
+ cat extensions/libip6t_$$ext.man ;\
+ done ;\
+ fi >>extensions/libip6t_targets.man
+
+EXTRAS += extensions/libip6t_matches.man
+extensions/libip6t_matches.man: $(patsubst %, extensions/libip6t_%.man, $(PF6_EXT_MAN_ALL_MATCHES))
+ @for ext in $(PF6_EXT_MAN_MATCHES); do \
+ echo ".SS $$ext" ;\
+ cat extensions/libip6t_$$ext.man ;\
+ done >extensions/libip6t_matches.man
+ @if [ -n "$(PF6_EXT_MAN_EXTRA_MATCHES)" ]; then \
+ for ext in $(PF6_EXT_MAN_EXTRA_MATCHES); do \
+ echo ".SS $$ext (not supported, see Patch-O-Matic)" ;\
+ cat extensions/libip6t_$$ext.man ;\
+ done ;\
+ fi >>extensions/libip6t_matches.man
+
$(DESTDIR)$(LIBDIR)/iptables/libipt_%.so: extensions/libipt_%.so
@[ -d $(DESTDIR)$(LIBDIR)/iptables ] || mkdir -p $(DESTDIR)$(LIBDIR)/iptables
cp $< $@
diff --git a/extensions/libip6t_HL.man b/extensions/libip6t_HL.man
new file mode 100644
index 00000000..6b8291d9
--- /dev/null
+++ b/extensions/libip6t_HL.man
@@ -0,0 +1,17 @@
+This is used to modify the IPv6 HOPLIMIT header field. The HOPLIMIT field is
+similar to what is known as TTL value in IPv4. Setting or incrementing the
+HOPLIMIT field can potentially be very dangerous, so it should be avoided at
+any cost.
+.TP
+.B Don't ever set or increment the value on packets that leave your local network!
+.B mangle
+table.
+.TP
+.BI "--hl-set " "value"
+Set the HOPLIMIT value to `value'.
+.TP
+.BI "--hl-dec " "value"
+Decrement the HOPLIMIT value `value' times.
+.TP
+.BI "--hl-inc " "value"
+Increment the HOPLIMIT value `value' times.
diff --git a/extensions/libip6t_LOG.man b/extensions/libip6t_LOG.man
new file mode 100644
index 00000000..9eb5a6ab
--- /dev/null
+++ b/extensions/libip6t_LOG.man
@@ -0,0 +1,28 @@
+Turn on kernel logging of matching packets. When this option is set
+for a rule, the Linux kernel will print some information on all
+matching packets (like most IPv6 IPv6-header fields) via the kernel log
+(where it can be read with
+.I dmesg
+or
+.IR syslogd (8)).
+This is a "non-terminating target", i.e. rule traversal continues at
+the next rule. So if you want to LOG the packets you refuse, use two
+separate rules with the same matching criteria, first using target LOG
+then DROP (or REJECT).
+.TP
+.BI "--log-level " "level"
+Level of logging (numeric or see \fIsyslog.conf\fP(5)).
+.TP
+.BI "--log-prefix " "prefix"
+Prefix log messages with the specified prefix; up to 29 letters long,
+and useful for distinguishing messages in the logs.
+.TP
+.B --log-tcp-sequence
+Log TCP sequence numbers. This is a security risk if the log is
+readable by users.
+.TP
+.B --log-tcp-options
+Log options from the TCP packet header.
+.TP
+.B --log-ip-options
+Log options from the IPv6 packet header.
diff --git a/extensions/libip6t_MARK.man b/extensions/libip6t_MARK.man
new file mode 100644
index 00000000..1f3260c5
--- /dev/null
+++ b/extensions/libip6t_MARK.man
@@ -0,0 +1,6 @@
+This is used to set the netfilter mark value associated with the
+packet. It is only valid in the
+.B mangle
+table.
+.TP
+.BI "--set-mark " "mark"
diff --git a/extensions/libip6t_REJECT.man b/extensions/libip6t_REJECT.man
new file mode 100644
index 00000000..75930f1e
--- /dev/null
+++ b/extensions/libip6t_REJECT.man
@@ -0,0 +1,34 @@
+This is used to send back an error packet in response to the matched
+packet: otherwise it is equivalent to
+.B DROP
+so it is a terminating TARGET, ending rule traversal.
+This target is only valid in the
+.BR INPUT ,
+.B FORWARD
+and
+.B OUTPUT
+chains, and user-defined chains which are only called from those
+chains. The following option controls the nature of the error packet
+returned:
+.TP
+.BI "--reject-with " "type"
+The type given can be
+.nf
+.B " icmp6-no-route"
+.B " no-route"
+.B " icmp6-adm-prohibited"
+.B " adm-prohibited"
+.B " icmp6-addr-unreachable"
+.B " addr-unreach"
+.B " icmp6-port-unreachable"
+.B " port-unreach"
+.fi
+which return the appropriate IPv6-ICMP error message (\fBport-unreach\fP is
+the default). Finally, the option
+.B tcp-reset
+can be used on rules which only match the TCP protocol: this causes a
+TCP RST packet to be sent back. This is mainly useful for blocking
+.I ident
+(113/tcp) probes which frequently occur when sending mail to broken mail
+hosts (which won't accept your mail otherwise).
+
diff --git a/extensions/libip6t_ROUTE.man b/extensions/libip6t_ROUTE.man
new file mode 100644
index 00000000..145d748d
--- /dev/null
+++ b/extensions/libip6t_ROUTE.man
@@ -0,0 +1,12 @@
+This is used to explicitly override the core network stack's routing decision.
+.B mangle
+table.
+.TP
+.BI "--oif " "ifname"
+Route the packet through `ifname' network interface
+.TP
+.BI "--gw " "IPv6_address"
+Route the packet via this gateway
+.TP
+.BI "--continue "
+Behave like a non-terminating target and continue traversing the rules
diff --git a/extensions/libip6t_TRACE.man b/extensions/libip6t_TRACE.man
new file mode 100644
index 00000000..549ab33b
--- /dev/null
+++ b/extensions/libip6t_TRACE.man
@@ -0,0 +1,3 @@
+This target has no options. It just turns on
+.B packet tracing
+for all packets that match this rule.
diff --git a/extensions/libip6t_ah.man b/extensions/libip6t_ah.man
new file mode 100644
index 00000000..97de1e19
--- /dev/null
+++ b/extensions/libip6t_ah.man
@@ -0,0 +1,3 @@
+This module matches the SPIs in AH header of IPSec packets.
+.TP
+.BR "--ahspi " "[!] \fIspi\fP[:\fIspi\fP]"
diff --git a/extensions/libip6t_condition.man b/extensions/libip6t_condition.man
new file mode 100644
index 00000000..30c478cd
--- /dev/null
+++ b/extensions/libip6t_condition.man
@@ -0,0 +1,4 @@
+This matches if a specific /proc filename is '0' or '1'.
+.TP
+.BI "--condition " "[!] filename"
+Match on boolean value stored in /proc/net/ip6t_condition/filename file
diff --git a/extensions/libip6t_dst.man b/extensions/libip6t_dst.man
new file mode 100644
index 00000000..168a10fb
--- /dev/null
+++ b/extensions/libip6t_dst.man
@@ -0,0 +1,7 @@
+This module matches the IPv6 destination header options
+.TP
+.BI "--dst-len" "[!]" "length"
+Total length of this header
+.TP
+.BI "--dst-opts " "TYPE[:LEN],[,TYPE[:LEN]...]"
+Options and it's length (List).
diff --git a/extensions/libip6t_esp.man b/extensions/libip6t_esp.man
new file mode 100644
index 00000000..7b84368d
--- /dev/null
+++ b/extensions/libip6t_esp.man
@@ -0,0 +1,3 @@
+This module matches the SPIs in ESP header of IPSec packets.
+.TP
+.BR "--espspi " "[!] \fIspi\fP[:\fIspi\fP]"
diff --git a/extensions/libip6t_eui64.man b/extensions/libip6t_eui64.man
new file mode 100644
index 00000000..24fc56c6
--- /dev/null
+++ b/extensions/libip6t_eui64.man
@@ -0,0 +1 @@
+This module matches the EUI64 part of a stateless autoconfigured IPv6 address. It compares the source MAC address with the lower 64 bits of the IPv6 address.
diff --git a/extensions/libip6t_frag.man b/extensions/libip6t_frag.man
new file mode 100644
index 00000000..fff3db3b
--- /dev/null
+++ b/extensions/libip6t_frag.man
@@ -0,0 +1,19 @@
+This module matches the time IPv6 fragmentathion header
+.TP
+.BI "--fragid " "[!]" "id[:id]"
+Matches the given fragmentation ID (range).
+.TP
+.BI "--fraglen " "[!]" "length"
+Matches the total length of this header.
+.TP
+.BI "--fragres "
+Matches the reserved field, too.
+.TP
+.BI "--fragfirst "
+Matches on the first fragment.
+.TP
+.BI "[--fragmore]"
+Matches if there are more fragments.
+.TP
+.BI "[--fraglast]"
+Matches if this is the last fragement.
diff --git a/extensions/libip6t_fuzzy.man b/extensions/libip6t_fuzzy.man
new file mode 100644
index 00000000..270c8d62
--- /dev/null
+++ b/extensions/libip6t_fuzzy.man
@@ -0,0 +1,7 @@
+This module matches a rate limit based on a fuzzy logic controller [FLC]
+.TP
+.BI "--lower-limit "number"
+Specifies the lower limit (in packets per second).
+.TP
+.BI "--upper-limit " "number"
+Specifies the upper limit (in packets per second).
diff --git a/extensions/libip6t_hbh.man b/extensions/libip6t_hbh.man
new file mode 100644
index 00000000..8376f915
--- /dev/null
+++ b/extensions/libip6t_hbh.man
@@ -0,0 +1,7 @@
+This module matches the IPv6 hop-by-hop header options
+.TP
+.BI "--hbh-len" "[!]" "length"
+Total length of this header
+.TP
+.BI "--hbh-opts " "TYPE[:LEN],[,TYPE[:LEN]...]"
+Options and it's length (List).
diff --git a/extensions/libip6t_hl.man b/extensions/libip6t_hl.man
new file mode 100644
index 00000000..9fcb730d
--- /dev/null
+++ b/extensions/libip6t_hl.man
@@ -0,0 +1,10 @@
+This module matches the HOPLIMIT field in the IPv6 header.
+.TP
+.BI "--hl-eq " "value"
+Matches if HOPLIMIT equals the given value.
+.TP
+.BI "--hl-lt " "ttl"
+Matches if HOPLIMIT is less than the given value.
+.TP
+.BI "--hl-gt " "ttl"
+Matches if HOPLIMIT is greater than the given value.
diff --git a/extensions/libip6t_icmpv6.man b/extensions/libip6t_icmpv6.man
new file mode 100644
index 00000000..27029544
--- /dev/null
+++ b/extensions/libip6t_icmpv6.man
@@ -0,0 +1,9 @@
+This extension is loaded if `--protocol ipv6-icmp' or `--protocol icmpv6' is
+specified. It provides the following option:
+.TP
+.BR "--icmpv6-type " "[!] \fItypename\fP"
+This allows specification of the ICMP type, which can be a numeric
+IPv6-ICMP type, or one of the IPv6-ICMP type names shown by the command
+.nf
+ ip6tables -p ipv6-icmp -h
+.fi
diff --git a/extensions/libip6t_ipv6header.man b/extensions/libip6t_ipv6header.man
new file mode 100644
index 00000000..bec3e184
--- /dev/null
+++ b/extensions/libip6t_ipv6header.man
@@ -0,0 +1,10 @@
+This module matches on IPv6 option headers
+.TP
+.BI "--header " "[!]" "headers"
+Matches the given type of headers.
+Names: hop,dst,route,frag,auth,esp,none,proto
+Long Names: hop-by-hop,ipv6-opts,ipv6-route,ipv6-frag,ah,esp,ipv6-nonxt,protocol
+Numbers: 0,60,43,44,51,50,59
+.TP
+.BI "--soft"
+The header CONTAINS the specified extensions.
diff --git a/extensions/libip6t_length.man b/extensions/libip6t_length.man
new file mode 100644
index 00000000..72a6b5dc
--- /dev/null
+++ b/extensions/libip6t_length.man
@@ -0,0 +1,4 @@
+This module matches the length of a packet against a specific value
+or range of values.
+.TP
+.BR "--length " "\fIlength\fP[:\fIlength\fP]"
diff --git a/extensions/libip6t_limit.man b/extensions/libip6t_limit.man
new file mode 100644
index 00000000..84b63d4e
--- /dev/null
+++ b/extensions/libip6t_limit.man
@@ -0,0 +1,15 @@
+This module matches at a limited rate using a token bucket filter.
+A rule using this extension will match until this limit is reached
+(unless the `!' flag is used). It can be used in combination with the
+.B LOG
+target to give limited logging, for example.
+.TP
+.BI "--limit " "rate"
+Maximum average matching rate: specified as a number, with an optional
+`/second', `/minute', `/hour', or `/day' suffix; the default is
+3/hour.
+.TP
+.BI "--limit-burst " "number"
+Maximum initial number of packets to match: this number gets
+recharged by one every time the limit specified above is not reached,
+up to this number; the default is 5.
diff --git a/extensions/libip6t_mac.man b/extensions/libip6t_mac.man
new file mode 100644
index 00000000..5321ca1c
--- /dev/null
+++ b/extensions/libip6t_mac.man
@@ -0,0 +1,10 @@
+.TP
+.BR "--mac-source " "[!] \fIaddress\fP"
+Match source MAC address. It must be of the form XX:XX:XX:XX:XX:XX.
+Note that this only makes sense for packets coming from an Ethernet device
+and entering the
+.BR PREROUTING ,
+.B FORWARD
+or
+.B INPUT
+chains.
diff --git a/extensions/libip6t_mark.man b/extensions/libip6t_mark.man
new file mode 100644
index 00000000..05f8e1ec
--- /dev/null
+++ b/extensions/libip6t_mark.man
@@ -0,0 +1,9 @@
+This module matches the netfilter mark field associated with a packet
+(which can be set using the
+.B MARK
+target below).
+.TP
+.BR "--mark " "\fIvalue\fP[/\fImask\fP]"
+Matches packets with the given unsigned mark value (if a mask is
+specified, this is logically ANDed with the mask before the
+comparison).
diff --git a/extensions/libip6t_multiport.man b/extensions/libip6t_multiport.man
new file mode 100644
index 00000000..cead84e7
--- /dev/null
+++ b/extensions/libip6t_multiport.man
@@ -0,0 +1,19 @@
+This module matches a set of source or destination ports. Up to 15
+ports can be specified. It can only be used in conjunction with
+.B "-p tcp"
+or
+.BR "-p udp" .
+.TP
+.BR "--source-ports " "\fIport\fP[,\fIport\fP[,\fIport\fP...]]"
+Match if the source port is one of the given ports. The flag
+.B --sports
+is a convenient alias for this option.
+.TP
+.BR "--destination-ports " "\fIport\fP[,\fIport\fP[,\fIport\fP...]]"
+Match if the destination port is one of the given ports. The flag
+.B --dports
+is a convenient alias for this option.
+.TP
+.BR "--ports " "\fIport\fP[,\fIport\fP[,\fIport\fP...]]"
+Match if the both the source and destination ports are equal to each
+other and to one of the given ports.
diff --git a/extensions/libip6t_nth.man b/extensions/libip6t_nth.man
new file mode 100644
index 00000000..d215fd55
--- /dev/null
+++ b/extensions/libip6t_nth.man
@@ -0,0 +1,14 @@
+This module matches every `n'th packet
+.TP
+.BI "--every " "value"
+Match every `value' packet
+.TP
+.BI "[" "--counter " "num" "]"
+Use internal counter number `num'. Default is `0'.
+.TP
+.BI "[" "--start " "num" "]"
+Initialize the counter at the number `num' insetad of `0'. Most between `0'
+and `value'-1.
+.TP
+.BI "[" "--packet " "num" "]"
+Match on `num' packet. Most be between `0' and `value'-1.
diff --git a/extensions/libip6t_owner.man b/extensions/libip6t_owner.man
new file mode 100644
index 00000000..8a31ca40
--- /dev/null
+++ b/extensions/libip6t_owner.man
@@ -0,0 +1,21 @@
+This module attempts to match various characteristics of the packet
+creator, for locally-generated packets. It is only valid in the
+.B OUTPUT
+chain, and even this some packets (such as ICMP ping responses) may
+have no owner, and hence never match. This is regarded as experimental.
+.TP
+.BI "--uid-owner " "userid"
+Matches if the packet was created by a process with the given
+effective user id.
+.TP
+.BI "--gid-owner " "groupid"
+Matches if the packet was created by a process with the given
+effective group id.
+.TP
+.BI "--pid-owner " "processid"
+Matches if the packet was created by a process with the given
+process id.
+.TP
+.BI "--sid-owner " "sessionid"
+Matches if the packet was created by a process in the given session
+group.
diff --git a/extensions/libip6t_random.man b/extensions/libip6t_random.man
new file mode 100644
index 00000000..f808a779
--- /dev/null
+++ b/extensions/libip6t_random.man
@@ -0,0 +1,4 @@
+This module randomly matches a certain percentage of all packets.
+.TP
+.BI "--average " "percent"
+Matches the given percentage. If omitted, a probability of 50% is set.
diff --git a/extensions/libip6t_rt.man b/extensions/libip6t_rt.man
new file mode 100644
index 00000000..4347ecd1
--- /dev/null
+++ b/extensions/libip6t_rt.man
@@ -0,0 +1,19 @@
+Match on IPv6 routing header
+.TP
+.BI "--rt-type " "[!]" "type"
+Match the type (numeric).
+.TP
+.BI "--rt-segsleft" "[!]" "num[:num]"
+Match the `segments left' field (range).
+.TP
+.BI "--rt-len" "[!]" "length"
+Match the length of this header
+.TP
+.BI "--rt-0-res"
+Match the reserved field, too (type=0)
+.TP
+.BI "--rt-0-addrs ADDR[,ADDR...]
+Match type=0 addresses (list).
+.TP
+.BI "--rt-0-not-strict"
+List of type=0 addresses is not a strict list.
diff --git a/extensions/libip6t_tcp.man b/extensions/libip6t_tcp.man
new file mode 100644
index 00000000..75d172e1
--- /dev/null
+++ b/extensions/libip6t_tcp.man
@@ -0,0 +1,45 @@
+These extensions are loaded if `--protocol tcp' is specified. It
+provides the following options:
+.TP
+.BR "--source-port " "[!] \fIport\fP[:\fIport\fP]"
+Source port or port range specification. This can either be a service
+name or a port number. An inclusive range can also be specified,
+using the format
+.IR port : port .
+If the first port is omitted, "0" is assumed; if the last is omitted,
+"65535" is assumed.
+If the second port greater then the first they will be swapped.
+The flag
+.B --sport
+is a convenient alias for this option.
+.TP
+.BR "--destination-port " "[!] \fIport\fP[:\fIport\fP]"
+Destination port or port range specification. The flag
+.B --dport
+is a convenient alias for this option.
+.TP
+.BR "--tcp-flags " "[!] \fImask\fP \fIcomp\fP"
+Match when the TCP flags are as specified. The first argument is the
+flags which we should examine, written as a comma-separated list, and
+the second argument is a comma-separated list of flags which must be
+set. Flags are:
+.BR "SYN ACK FIN RST URG PSH ALL NONE" .
+Hence the command
+.nf
+ ip6tables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST SYN
+.fi
+will only match packets with the SYN flag set, and the ACK, FIN and
+RST flags unset.
+.TP
+.B "[!] --syn"
+Only match TCP packets with the SYN bit set and the ACK and RST bits
+cleared. Such packets are used to request TCP connection initiation;
+for example, blocking such packets coming in an interface will prevent
+incoming TCP connections, but outgoing TCP connections will be
+unaffected.
+It is equivalent to \fB--tcp-flags SYN,RST,ACK SYN\fP.
+If the "!" flag precedes the "--syn", the sense of the
+option is inverted.
+.TP
+.BR "--tcp-option " "[!] \fInumber\fP"
+Match if TCP option set.
diff --git a/extensions/libip6t_udp.man b/extensions/libip6t_udp.man
new file mode 100644
index 00000000..04084797
--- /dev/null
+++ b/extensions/libip6t_udp.man
@@ -0,0 +1,14 @@
+These extensions are loaded if `--protocol udp' is specified. It
+provides the following options:
+.TP
+.BR "--source-port " "[!] \fIport\fP[:\fIport\fP]"
+Source port or port range specification.
+See the description of the
+.B --source-port
+option of the TCP extension for details.
+.TP
+.BR "--destination-port " "[!] \fIport\fP[:\fIport\fP]"
+Destination port or port range specification.
+See the description of the
+.B --destination-port
+option of the TCP extension for details.
diff --git a/extensions/libipt_BALANCE.man b/extensions/libipt_BALANCE.man
new file mode 100644
index 00000000..0eb09d07
--- /dev/null
+++ b/extensions/libipt_BALANCE.man
@@ -0,0 +1,4 @@
+This allows you to DNAT connections in a round-robin way over a given range of destination addresses.
+.TP
+.BI "--to-destination " "ipaddr-ipaddr"
+Address range to round-robin over.
diff --git a/extensions/libipt_CLASSIFY.man b/extensions/libipt_CLASSIFY.man
new file mode 100644
index 00000000..393c329e
--- /dev/null
+++ b/extensions/libipt_CLASSIFY.man
@@ -0,0 +1,4 @@
+This module allows you to set the skb->priority value (and thus classify the packet into a specific CBQ class).
+.TP
+.BI "--set-class " "MAJOR:MINOR"
+Set the major and minor class value.
diff --git a/extensions/libipt_CLUSTERIP.man b/extensions/libipt_CLUSTERIP.man
new file mode 100644
index 00000000..8e766f37
--- /dev/null
+++ b/extensions/libipt_CLUSTERIP.man
@@ -0,0 +1,24 @@
+This module allows you to configure a simple cluster of nodes that share
+a certain IP and MAC address without an explicit load balancer in front of
+them. Connections are statically distributed between the nodes in this
+cluster.
+.TP
+.BI "--new "
+Create a new ClusterIP. You always have to set this on the first rule
+for a given ClusterIP.
+.TP
+.BI "--hashmode " "mode"
+Specify the hashing mode. Has to be one of
+.B sourceip, sourceip-sourceport, sourceip-sourceport-destport
+.TP
+.BI "--clustermac " "mac"
+Specify the ClusterIP MAC address. Has to be a link-layer multicast address
+.TP
+.BI "--total-nodes " "num"
+Number of total nodes within this cluster.
+.TP
+.BI "--local-node " "num"
+Local node number within this cluster.
+.TP
+.BI "--hash-init " "rnd"
+Specify the random seed used for hash initialization.
diff --git a/extensions/libipt_CONNMARK.man b/extensions/libipt_CONNMARK.man
new file mode 100644
index 00000000..64a0222d
--- /dev/null
+++ b/extensions/libipt_CONNMARK.man
@@ -0,0 +1,13 @@
+This target allows you to mark that connection with an arbitrary walue. This
+value can later be matched via the
+.B connmark
+match.
+.TP
+.BI "--set-mark " "mark"
+Set the conntrack mark,
+.TP
+.BI "--save-mark"
+Save the packet nfmark on the connection mark.
+.TP
+.BI "--restore-mark"
+Restore the saved nfmark value from the connection mark.
diff --git a/extensions/libipt_DNAT.man b/extensions/libipt_DNAT.man
new file mode 100644
index 00000000..7579e14e
--- /dev/null
+++ b/extensions/libipt_DNAT.man
@@ -0,0 +1,27 @@
+This target is only valid in the
+.B nat
+table, in the
+.B PREROUTING
+and
+.B OUTPUT
+chains, and user-defined chains which are only called from those
+chains. It specifies that the destination address of the packet
+should be modified (and all future packets in this connection will
+also be mangled), and rules should cease being examined. It takes one
+type of option:
+.TP
+.BR "--to-destination " "\fIipaddr\fP[-\fIipaddr\fP][:\fIport\fP-\fIport\fP]"
+which can specify a single new destination IP address, an inclusive
+range of IP addresses, and optionally, a port range (which is only
+valid if the rule also specifies
+.B "-p tcp"
+or
+.BR "-p udp" ).
+If no port range is specified, then the destination port will never be
+modified.
+.RS
+.PP
+You can add several --to-destination options. If you specify more
+than one destination address, either via an address range or multiple
+--to-destination options, a simple round-robin (one after another in
+cycle) load balancing takes place between these adresses.
diff --git a/extensions/libipt_DSCP.man b/extensions/libipt_DSCP.man
new file mode 100644
index 00000000..e8e5cf5b
--- /dev/null
+++ b/extensions/libipt_DSCP.man
@@ -0,0 +1,9 @@
+This target allows to alter the value of the DSCP bits within the TOS
+header of the IPv4 packet. As this manipulates a packet, it can only
+be used in the mangle table.
+.TP
+.BI "--set-dscp " "value"
+Set the DSCP field to a numerical value (can be decimal or hex)
+.TP
+.BI "--set-dscp-class " "class"
+Set the DSCP field to a DiffServ class.
diff --git a/extensions/libipt_ECN.man b/extensions/libipt_ECN.man
new file mode 100644
index 00000000..3668490b
--- /dev/null
+++ b/extensions/libipt_ECN.man
@@ -0,0 +1,7 @@
+This target allows to selectively work around known ECN blackholes.
+It can only be used in the mangle table.
+.TP
+.BI "--ecn-tcp-remove"
+Remove all ECN bits from the TCP header. Of course, it can only be used
+in conjunction with
+.BR "-p tcp" .
diff --git a/extensions/libipt_LOG.man b/extensions/libipt_LOG.man
new file mode 100644
index 00000000..c604c76c
--- /dev/null
+++ b/extensions/libipt_LOG.man
@@ -0,0 +1,28 @@
+Turn on kernel logging of matching packets. When this option is set
+for a rule, the Linux kernel will print some information on all
+matching packets (like most IP header fields) via the kernel log
+(where it can be read with
+.I dmesg
+or
+.IR syslogd (8)).
+This is a "non-terminating target", i.e. rule traversal continues at
+the next rule. So if you want to LOG the packets you refuse, use two
+separate rules with the same matching criteria, first using target LOG
+then DROP (or REJECT).
+.TP
+.BI "--log-level " "level"
+Level of logging (numeric or see \fIsyslog.conf\fP(5)).
+.TP
+.BI "--log-prefix " "prefix"
+Prefix log messages with the specified prefix; up to 29 letters long,
+and useful for distinguishing messages in the logs.
+.TP
+.B --log-tcp-sequence
+Log TCP sequence numbers. This is a security risk if the log is
+readable by users.
+.TP
+.B --log-tcp-options
+Log options from the TCP packet header.
+.TP
+.B --log-ip-options
+Log options from the IP packet header.
diff --git a/extensions/libipt_MARK.man b/extensions/libipt_MARK.man
new file mode 100644
index 00000000..1c47e97a
--- /dev/null
+++ b/extensions/libipt_MARK.man
@@ -0,0 +1,6 @@
+This is used to set the netfilter mark value associated with the
+packet. It is only valid in the
+.B mangle
+table. It can for example be used in conjunction with iproute2.
+.TP
+.BI "--set-mark " "mark"
diff --git a/extensions/libipt_MASQUERADE.man b/extensions/libipt_MASQUERADE.man
new file mode 100644
index 00000000..e82063cc
--- /dev/null
+++ b/extensions/libipt_MASQUERADE.man
@@ -0,0 +1,22 @@
+This target is only valid in the
+.B nat
+table, in the
+.B POSTROUTING
+chain. It should only be used with dynamically assigned IP (dialup)
+connections: if you have a static IP address, you should use the SNAT
+target. Masquerading is equivalent to specifying a mapping to the IP
+address of the interface the packet is going out, but also has the
+effect that connections are
+.I forgotten
+when the interface goes down. This is the correct behavior when the
+next dialup is unlikely to have the same interface address (and hence
+any established connections are lost anyway). It takes one option:
+.TP
+.BR "--to-ports " "\fIport\fP[-\fIport\fP]"
+This specifies a range of source ports to use, overriding the default
+.B SNAT
+source port-selection heuristics (see above). This is only valid
+if the rule also specifies
+.B "-p tcp"
+or
+.BR "-p udp" .
diff --git a/extensions/libipt_MIRROR.man b/extensions/libipt_MIRROR.man
new file mode 100644
index 00000000..7b720bcb
--- /dev/null
+++ b/extensions/libipt_MIRROR.man
@@ -0,0 +1,12 @@
+This is an experimental demonstration target which inverts the source
+and destination fields in the IP header and retransmits the packet.
+It is only valid in the
+.BR INPUT ,
+.B FORWARD
+and
+.B PREROUTING
+chains, and user-defined chains which are only called from those
+chains. Note that the outgoing packets are
+.B NOT
+seen by any packet filtering chains, connection tracking or NAT, to
+avoid loops and other problems.
diff --git a/extensions/libipt_NETMAP.man b/extensions/libipt_NETMAP.man
new file mode 100644
index 00000000..d49a025d
--- /dev/null
+++ b/extensions/libipt_NETMAP.man
@@ -0,0 +1,9 @@
+This target allows you to statically map a whole network of addresses onto
+another network of addresses. It can only be used from rules in the
+.B nat
+table.
+.TP
+.BI "--to " "address[/mask]"
+Network address to map to. The resulting address will be constructed in the
+following way: All 'one' bits in the mask are filled in from the new `address'.
+All bits that are zero in the mask are filled in from the original address.
diff --git a/extensions/libipt_NOTRACK.man b/extensions/libipt_NOTRACK.man
new file mode 100644
index 00000000..30e830ad
--- /dev/null
+++ b/extensions/libipt_NOTRACK.man
@@ -0,0 +1,5 @@
+This target disables connection tracking for all packets matching that rule.
+.TP
+It can only be used in the
+.B raw
+table.
diff --git a/extensions/libipt_REDIRECT.man b/extensions/libipt_REDIRECT.man
new file mode 100644
index 00000000..19fa917c
--- /dev/null
+++ b/extensions/libipt_REDIRECT.man
@@ -0,0 +1,18 @@
+This target is only valid in the
+.B nat
+table, in the
+.B PREROUTING
+and
+.B OUTPUT
+chains, and user-defined chains which are only called from those
+chains. It alters the destination IP address to send the packet to
+the machine itself (locally-generated packets are mapped to the
+127.0.0.1 address). It takes one option:
+.TP
+.BR "--to-ports " "\fIport\fP[-\fIport\fP]"
+This specifies a destination port or range of ports to use: without
+this, the destination port is never altered. This is only valid
+if the rule also specifies
+.B "-p tcp"
+or
+.BR "-p udp" .
diff --git a/extensions/libipt_REJECT.man b/extensions/libipt_REJECT.man
new file mode 100644
index 00000000..174bf7b3
--- /dev/null
+++ b/extensions/libipt_REJECT.man
@@ -0,0 +1,34 @@
+This is used to send back an error packet in response to the matched
+packet: otherwise it is equivalent to
+.B DROP
+so it is a terminating TARGET, ending rule traversal.
+This target is only valid in the
+.BR INPUT ,
+.B FORWARD
+and
+.B OUTPUT
+chains, and user-defined chains which are only called from those
+chains. The following option controls the nature of the error packet
+returned:
+.TP
+.BI "--reject-with " "type"
+The type given can be
+.nf
+.B " icmp-net-unreachable"
+.B " icmp-host-unreachable"
+.B " icmp-port-unreachable"
+.B " icmp-proto-unreachable"
+.B " icmp-net-prohibited"
+.B " icmp-host-prohibited or"
+.B " icmp-admin-prohibited (*)"
+.fi
+which return the appropriate ICMP error message (\fBport-unreachable\fP is
+the default). The option
+.B tcp-reset
+can be used on rules which only match the TCP protocol: this causes a
+TCP RST packet to be sent back. This is mainly useful for blocking
+.I ident
+(113/tcp) probes which frequently occur when sending mail to broken mail
+hosts (which won't accept your mail otherwise).
+.TP
+(*) Using icmp-admin-prohibited with kernels that do not support it will result in a plain DROP instead of REJECT
diff --git a/extensions/libipt_ROUTE.man b/extensions/libipt_ROUTE.man
new file mode 100644
index 00000000..dae1cb5f
--- /dev/null
+++ b/extensions/libipt_ROUTE.man
@@ -0,0 +1,15 @@
+This is used to explicitly override the core network stack's routing decision.
+.B mangle
+table.
+.TP
+.BI "--oif " "ifname"
+Route the packet through `ifname' network interface
+.TP
+.BI "--iif " "ifname"
+Change the packet's incoming interface to `ifname'
+.TP
+.BI "--gw " "IP_address"
+Route the packet via this gateway
+.TP
+.BI "--continue "
+Behave like a non-terminating target and continue traversing the rules. Not valid in combination with `--iif'
diff --git a/extensions/libipt_SNAT.man b/extensions/libipt_SNAT.man
new file mode 100644
index 00000000..4cc03970
--- /dev/null
+++ b/extensions/libipt_SNAT.man
@@ -0,0 +1,26 @@
+This target is only valid in the
+.B nat
+table, in the
+.B POSTROUTING
+chain. It specifies that the source address of the packet should be
+modified (and all future packets in this connection will also be
+mangled), and rules should cease being examined. It takes one type
+of option:
+.TP
+.BR "--to-source " "\fIipaddr\fP[-\fIipaddr\fP][:\fIport\fP-\fIport\fP]"
+which can specify a single new source IP address, an inclusive range
+of IP addresses, and optionally, a port range (which is only valid if
+the rule also specifies
+.B "-p tcp"
+or
+.BR "-p udp" ).
+If no port range is specified, then source ports below 512 will be
+mapped to other ports below 512: those between 512 and 1023 inclusive
+will be mapped to ports below 1024, and other ports will be mapped to
+1024 or above. Where possible, no port alteration will occur.
+.RS
+.PP
+You can add several --to-source options. If you specify more
+than one source address, either via an address range or multiple
+--to-source options, a simple round-robin (one after another in
+cycle) takes place between these adresses.
diff --git a/extensions/libipt_TCPMSS.man b/extensions/libipt_TCPMSS.man
new file mode 100644
index 00000000..da1bce2d
--- /dev/null
+++ b/extensions/libipt_TCPMSS.man
@@ -0,0 +1,38 @@
+This target allows to alter the MSS value of TCP SYN packets, to control
+the maximum size for that connection (usually limiting it to your
+outgoing interface's MTU minus 40). Of course, it can only be used
+in conjunction with
+.BR "-p tcp" .
+.br
+This target is used to overcome criminally braindead ISPs or servers
+which block ICMP Fragmentation Needed packets. The symptoms of this
+problem are that everything works fine from your Linux
+firewall/router, but machines behind it can never exchange large
+packets:
+.PD 0
+.RS 0.1i
+.TP 0.3i
+1)
+Web browsers connect, then hang with no data received.
+.TP
+2)
+Small mail works fine, but large emails hang.
+.TP
+3)
+ssh works fine, but scp hangs after initial handshaking.
+.RE
+.PD
+Workaround: activate this option and add a rule to your firewall
+configuration like:
+.nf
+ iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \\
+ -j TCPMSS --clamp-mss-to-pmtu
+.fi
+.TP
+.BI "--set-mss " "value"
+Explicitly set MSS option to specified value.
+.TP
+.B "--clamp-mss-to-pmtu"
+Automatically clamp MSS value to (path_MTU - 40).
+.TP
+These options are mutually exclusive.
diff --git a/extensions/libipt_TOS.man b/extensions/libipt_TOS.man
new file mode 100644
index 00000000..c31b068d
--- /dev/null
+++ b/extensions/libipt_TOS.man
@@ -0,0 +1,11 @@
+This is used to set the 8-bit Type of Service field in the IP header.
+It is only valid in the
+.B mangle
+table.
+.TP
+.BI "--set-tos " "tos"
+You can use a numeric TOS values, or use
+.nf
+ iptables -j TOS -h
+.fi
+to see the list of valid TOS names.
diff --git a/extensions/libipt_TRACE.man b/extensions/libipt_TRACE.man
new file mode 100644
index 00000000..549ab33b
--- /dev/null
+++ b/extensions/libipt_TRACE.man
@@ -0,0 +1,3 @@
+This target has no options. It just turns on
+.B packet tracing
+for all packets that match this rule.
diff --git a/extensions/libipt_TTL.man b/extensions/libipt_TTL.man
new file mode 100644
index 00000000..97c46c43
--- /dev/null
+++ b/extensions/libipt_TTL.man
@@ -0,0 +1,19 @@
+This is used to modify the IPv4 TTL header field. The TTL field determines
+how many hops (routers) a packet can traverse until it's time to live is
+exceeded.
+.TP
+Setting or incrementing the TTL field can potentially be very dangerous,
+so it should be avoided at any cost.
+.TP
+.B Don't ever set or increment the value on packets that leave your local network!
+.B mangle
+table.
+.TP
+.BI "--ttl-set " "value"
+Set the TTL value to `value'.
+.TP
+.BI "--ttl-dec " "value"
+Decrement the TTL value `value' times.
+.TP
+.BI "--ttl-inc " "value"
+Increment the TTL value `value' times.
diff --git a/extensions/libipt_ULOG.man b/extensions/libipt_ULOG.man
new file mode 100644
index 00000000..51aa619f
--- /dev/null
+++ b/extensions/libipt_ULOG.man
@@ -0,0 +1,27 @@
+This target provides userspace logging of matching packets. When this
+target is set for a rule, the Linux kernel will multicast this packet
+through a
+.IR netlink
+socket. One or more userspace processes may then subscribe to various
+multicast groups and receive the packets.
+Like LOG, this is a "non-terminating target", i.e. rule traversal
+continues at the next rule.
+.TP
+.BI "--ulog-nlgroup " "nlgroup"
+This specifies the netlink group (1-32) to which the packet is sent.
+Default value is 1.
+.TP
+.BI "--ulog-prefix " "prefix"
+Prefix log messages with the specified prefix; up to 32 characters
+long, and useful for distinguishing messages in the logs.
+.TP
+.BI "--ulog-cprange " "size"
+Number of bytes to be copied to userspace. A value of 0 always copies
+the entire packet, regardless of its size. Default is 0.
+.TP
+.BI "--ulog-qthreshold " "size"
+Number of packet to queue inside kernel. Setting this value to, e.g. 10
+accumulates ten packets inside the kernel and transmits them as one
+netlink multipart message to userspace. Default is 1 (for backwards
+compatibility).
+.br
diff --git a/extensions/libipt_addrtype.man b/extensions/libipt_addrtype.man
new file mode 100644
index 00000000..2c3bbab0
--- /dev/null
+++ b/extensions/libipt_addrtype.man
@@ -0,0 +1,37 @@
+This module matches packets based on their
+.B address type.
+Address types are used within the kernel networking stack and categorize
+addresses into various groups. The exact definition of that group depends on the specific layer three protocol.
+.TP
+The following address types are possible:
+.TP
+.BI "UNSPEC"
+an unspecified address (i.e. 0.0.0.0)
+.BI "UNICAST"
+an unicast address
+.BI "LOCAL"
+a local address
+.BI "BROADCAST"
+a broadcast address
+.BI "ANYCAST"
+an anycast packet
+.BI "MULTICAST"
+a multicast address
+.BI "BLACKHOLE"
+a blackhole address
+.BI "UNREACHABLE"
+an unreachable address
+.BI "PROHIBIT"
+a prohibited address
+.BI "THROW"
+FIXME
+.BI "NAT"
+FIXME
+.BI "XRESOLVE"
+FIXME
+.TP
+.BI "--src-type " "type"
+Matches if the source address is of given type
+.TP
+.BI "--dst-type " "type"
+Matches if the destination address is of given type
diff --git a/extensions/libipt_ah.man b/extensions/libipt_ah.man
new file mode 100644
index 00000000..97de1e19
--- /dev/null
+++ b/extensions/libipt_ah.man
@@ -0,0 +1,3 @@
+This module matches the SPIs in AH header of IPSec packets.
+.TP
+.BR "--ahspi " "[!] \fIspi\fP[:\fIspi\fP]"
diff --git a/extensions/libipt_condition.man b/extensions/libipt_condition.man
new file mode 100644
index 00000000..0fc51ffe
--- /dev/null
+++ b/extensions/libipt_condition.man
@@ -0,0 +1,4 @@
+This matches if a specific /proc filename is '0' or '1'.
+.TP
+.BI "--condition " "[!] filename"
+Match on boolean value stored in /proc/net/ipt_condition/filename file
diff --git a/extensions/libipt_conntrack.man b/extensions/libipt_conntrack.man
new file mode 100644
index 00000000..b732b28e
--- /dev/null
+++ b/extensions/libipt_conntrack.man
@@ -0,0 +1,49 @@
+This module, when combined with connection tracking, allows access to
+more connection tracking information than the "state" match.
+(this module is present only if iptables was compiled under a kernel
+supporting this feature)
+.TP
+.BI "--ctstate " "state"
+Where state is a comma separated list of the connection states to
+match. Possible states are
+.B INVALID
+meaning that the packet is associated with no known connection,
+.B ESTABLISHED
+meaning that the packet is associated with a connection which has seen
+packets in both directions,
+.B NEW
+meaning that the packet has started a new connection, or otherwise
+associated with a connection which has not seen packets in both
+directions, and
+.B RELATED
+meaning that the packet is starting a new connection, but is
+associated with an existing connection, such as an FTP data transfer,
+or an ICMP error.
+.B SNAT
+A virtual state, matching if the original source address differs from
+the reply destination.
+.B DNAT
+A virtual state, matching if the original destination differs from the
+reply source.
+.TP
+.BI "--ctproto " "proto"
+Protocol to match (by number or name)
+.TP
+.BI "--ctorigsrc " "[!] \fIaddress\fP[/\fImask\fP]"
+Match against original source address
+.TP
+.BI "--ctorigdst " "[!] \fIaddress\fP[/\fImask\fP]"
+Match against original destination address
+.TP
+.BI "--ctreplsrc " "[!] \fIaddress\fP[/\fImask\fP]"
+Match against reply source address
+.TP
+.BI "--ctrepldst " "[!] \fIaddress\fB[/\fImask\fP]"
+Match against reply destination address
+.TP
+.BI "--ctstatus " "[\fINONE|EXPECTED|SEEN_REPLY|ASSURED\fP][,...]"
+Match against internal conntrack states
+.TP
+.BI "--ctexpire " "\fItime\fP[\fI:time\fP]"
+Match remaining lifetime in seconds against given value
+or range of values (inclusive)
diff --git a/extensions/libipt_dscp.man b/extensions/libipt_dscp.man
new file mode 100644
index 00000000..4a842101
--- /dev/null
+++ b/extensions/libipt_dscp.man
@@ -0,0 +1,10 @@
+This module matches the 6 bit DSCP field within the TOS field in the
+IP header. DSCP has superseded TOS within the IETF.
+.TP
+.BI "--dscp " "value"
+Match against a numeric (decimal or hex) value [0-32].
+.TP
+.BI "--dscp-class " "\fIDiffServ Class\fP"
+Match the DiffServ class. This value may be any of the
+BE, EF, AFxx or CSx classes. It will then be converted
+into it's according numeric value.
diff --git a/extensions/libipt_dstlimit.man b/extensions/libipt_dstlimit.man
new file mode 100644
index 00000000..e4a4a5ab
--- /dev/null
+++ b/extensions/libipt_dstlimit.man
@@ -0,0 +1,35 @@
+This module allows you to limit the packet per second (pps) rate on a per
+destination IP or per destination port base. As opposed to the `limit' match,
+every destination ip / destination port has it's own limit.
+.TP
+.BI "--dstlimit " "avg"
+Maximum average match rate (packets per second unless followed by /sec /minute /hour /day postfixes).
+.TP
+.BI "--dstlimit-mode " "mode"
+The limiting hashmode. Is the specified limit per
+.B dstip, dstip-dstport
+tuple,
+.B srcip-dstip
+tuple, or per
+.B srcipdstip-dstport
+tuple.
+.TP
+.BI "--dstlimit-name " "name"
+Name for /proc/net/ipt_dstlimit/* file entry
+.TP
+.BI "[" "--dstlimit-burst " "burst" "]"
+Number of packets to match in a burst. Default: 5
+.TP
+.BI "[" "--dstlimit-htable-size " "size" "]"
+Number of buckets in the hashtable
+.TP
+.BI "[" "--dstlimit-htable-max " "max" "]"
+Maximum number of entries in the hashtable
+.TP
+.BI "[" "--dstlimit-htable-gcinterval " "interval" "]"
+Interval between garbage collection runs of the hashtable (in miliseconds).
+Default is 1000 (1 second).
+.TP
+.BI "[" "--dstlimit-htable-expire " "time"
+After which time are idle entries expired from hashtable (in miliseconds)?
+Default is 10000 (10 seconds).
diff --git a/extensions/libipt_ecn.man b/extensions/libipt_ecn.man
new file mode 100644
index 00000000..8ecfef59
--- /dev/null
+++ b/extensions/libipt_ecn.man
@@ -0,0 +1,11 @@
+This allows you to match the ECN bits of the IPv4 and TCP header. ECN is the Explicit Congestion Notification mechanism as specified in RFC3168
+.TP
+.BI "--ecn-tcp-cwr"
+This matches if the TCP ECN CWR (Congestion Window Received) bit is set.
+.TP
+.BI "--ecn-tcp-ece"
+This matches if the TCP ECN ECE (ECN Echo) bit is set.
+.TP
+.BI "--ecn-ip-ect " "num"
+This matches a particular IPv4 ECT (ECN-Capable Transport). You have to specify
+a number between `0' and `3'.
diff --git a/extensions/libipt_esp.man b/extensions/libipt_esp.man
new file mode 100644
index 00000000..7b84368d
--- /dev/null
+++ b/extensions/libipt_esp.man
@@ -0,0 +1,3 @@
+This module matches the SPIs in ESP header of IPSec packets.
+.TP
+.BR "--espspi " "[!] \fIspi\fP[:\fIspi\fP]"
diff --git a/extensions/libipt_fuzzy.man b/extensions/libipt_fuzzy.man
new file mode 100644
index 00000000..270c8d62
--- /dev/null
+++ b/extensions/libipt_fuzzy.man
@@ -0,0 +1,7 @@
+This module matches a rate limit based on a fuzzy logic controller [FLC]
+.TP
+.BI "--lower-limit "number"
+Specifies the lower limit (in packets per second).
+.TP
+.BI "--upper-limit " "number"
+Specifies the upper limit (in packets per second).
diff --git a/extensions/libipt_helper.man b/extensions/libipt_helper.man
new file mode 100644
index 00000000..c3221ad8
--- /dev/null
+++ b/extensions/libipt_helper.man
@@ -0,0 +1,11 @@
+This module matches packets related to a specific conntrack-helper.
+.TP
+.BI "--helper " "string"
+Matches packets related to the specified conntrack-helper.
+.RS
+.PP
+string can be "ftp" for packets related to a ftp-session on default port.
+For other ports append -portnr to the value, ie. "ftp-2121".
+.PP
+Same rules apply for other conntrack-helpers.
+.RE
diff --git a/extensions/libipt_icmp.man b/extensions/libipt_icmp.man
new file mode 100644
index 00000000..5b91514d
--- /dev/null
+++ b/extensions/libipt_icmp.man
@@ -0,0 +1,9 @@
+This extension is loaded if `--protocol icmp' is specified. It
+provides the following option:
+.TP
+.BR "--icmp-type " "[!] \fItypename\fP"
+This allows specification of the ICMP type, which can be a numeric
+ICMP type, or one of the ICMP type names shown by the command
+.nf
+ iptables -p icmp -h
+.fi
diff --git a/extensions/libipt_iprange.man b/extensions/libipt_iprange.man
new file mode 100644
index 00000000..57e1cff1
--- /dev/null
+++ b/extensions/libipt_iprange.man
@@ -0,0 +1,7 @@
+This matches on a given arbitrary range of IPv4 addresses
+.TP
+.BI "[!]" "--src-range " "ip-ip"
+Match source IP in the specified range.
+.TP
+.BI "[!]" "--dst-range " "ip-ip"
+Match destination IP in the specified range.
diff --git a/extensions/libipt_length.man b/extensions/libipt_length.man
new file mode 100644
index 00000000..72a6b5dc
--- /dev/null
+++ b/extensions/libipt_length.man
@@ -0,0 +1,4 @@
+This module matches the length of a packet against a specific value
+or range of values.
+.TP
+.BR "--length " "\fIlength\fP[:\fIlength\fP]"
diff --git a/extensions/libipt_limit.man b/extensions/libipt_limit.man
new file mode 100644
index 00000000..84b63d4e
--- /dev/null
+++ b/extensions/libipt_limit.man
@@ -0,0 +1,15 @@
+This module matches at a limited rate using a token bucket filter.
+A rule using this extension will match until this limit is reached
+(unless the `!' flag is used). It can be used in combination with the
+.B LOG
+target to give limited logging, for example.
+.TP
+.BI "--limit " "rate"
+Maximum average matching rate: specified as a number, with an optional
+`/second', `/minute', `/hour', or `/day' suffix; the default is
+3/hour.
+.TP
+.BI "--limit-burst " "number"
+Maximum initial number of packets to match: this number gets
+recharged by one every time the limit specified above is not reached,
+up to this number; the default is 5.
diff --git a/extensions/libipt_mac.man b/extensions/libipt_mac.man
new file mode 100644
index 00000000..5321ca1c
--- /dev/null
+++ b/extensions/libipt_mac.man
@@ -0,0 +1,10 @@
+.TP
+.BR "--mac-source " "[!] \fIaddress\fP"
+Match source MAC address. It must be of the form XX:XX:XX:XX:XX:XX.
+Note that this only makes sense for packets coming from an Ethernet device
+and entering the
+.BR PREROUTING ,
+.B FORWARD
+or
+.B INPUT
+chains.
diff --git a/extensions/libipt_mark.man b/extensions/libipt_mark.man
new file mode 100644
index 00000000..05f8e1ec
--- /dev/null
+++ b/extensions/libipt_mark.man
@@ -0,0 +1,9 @@
+This module matches the netfilter mark field associated with a packet
+(which can be set using the
+.B MARK
+target below).
+.TP
+.BR "--mark " "\fIvalue\fP[/\fImask\fP]"
+Matches packets with the given unsigned mark value (if a mask is
+specified, this is logically ANDed with the mask before the
+comparison).
diff --git a/extensions/libipt_mport.man b/extensions/libipt_mport.man
new file mode 100644
index 00000000..cead84e7
--- /dev/null
+++ b/extensions/libipt_mport.man
@@ -0,0 +1,19 @@
+This module matches a set of source or destination ports. Up to 15
+ports can be specified. It can only be used in conjunction with
+.B "-p tcp"
+or
+.BR "-p udp" .
+.TP
+.BR "--source-ports " "\fIport\fP[,\fIport\fP[,\fIport\fP...]]"
+Match if the source port is one of the given ports. The flag
+.B --sports
+is a convenient alias for this option.
+.TP
+.BR "--destination-ports " "\fIport\fP[,\fIport\fP[,\fIport\fP...]]"
+Match if the destination port is one of the given ports. The flag
+.B --dports
+is a convenient alias for this option.
+.TP
+.BR "--ports " "\fIport\fP[,\fIport\fP[,\fIport\fP...]]"
+Match if the both the source and destination ports are equal to each
+other and to one of the given ports.
diff --git a/extensions/libipt_multiport.man b/extensions/libipt_multiport.man
new file mode 100644
index 00000000..cead84e7
--- /dev/null
+++ b/extensions/libipt_multiport.man
@@ -0,0 +1,19 @@
+This module matches a set of source or destination ports. Up to 15
+ports can be specified. It can only be used in conjunction with
+.B "-p tcp"
+or
+.BR "-p udp" .
+.TP
+.BR "--source-ports " "\fIport\fP[,\fIport\fP[,\fIport\fP...]]"
+Match if the source port is one of the given ports. The flag
+.B --sports
+is a convenient alias for this option.
+.TP
+.BR "--destination-ports " "\fIport\fP[,\fIport\fP[,\fIport\fP...]]"
+Match if the destination port is one of the given ports. The flag
+.B --dports
+is a convenient alias for this option.
+.TP
+.BR "--ports " "\fIport\fP[,\fIport\fP[,\fIport\fP...]]"
+Match if the both the source and destination ports are equal to each
+other and to one of the given ports.
diff --git a/extensions/libipt_nth.man b/extensions/libipt_nth.man
new file mode 100644
index 00000000..d215fd55
--- /dev/null
+++ b/extensions/libipt_nth.man
@@ -0,0 +1,14 @@
+This module matches every `n'th packet
+.TP
+.BI "--every " "value"
+Match every `value' packet
+.TP
+.BI "[" "--counter " "num" "]"
+Use internal counter number `num'. Default is `0'.
+.TP
+.BI "[" "--start " "num" "]"
+Initialize the counter at the number `num' insetad of `0'. Most between `0'
+and `value'-1.
+.TP
+.BI "[" "--packet " "num" "]"
+Match on `num' packet. Most be between `0' and `value'-1.
diff --git a/extensions/libipt_owner.man b/extensions/libipt_owner.man
new file mode 100644
index 00000000..1394aca6
--- /dev/null
+++ b/extensions/libipt_owner.man
@@ -0,0 +1,26 @@
+This module attempts to match various characteristics of the packet
+creator, for locally-generated packets. It is only valid in the
+.B OUTPUT
+chain, and even this some packets (such as ICMP ping responses) may
+have no owner, and hence never match.
+.TP
+.BI "--uid-owner " "userid"
+Matches if the packet was created by a process with the given
+effective user id.
+.TP
+.BI "--gid-owner " "groupid"
+Matches if the packet was created by a process with the given
+effective group id.
+.TP
+.BI "--pid-owner " "processid"
+Matches if the packet was created by a process with the given
+process id.
+.TP
+.BI "--sid-owner " "sessionid"
+Matches if the packet was created by a process in the given session
+group.
+.TP
+.BI "--cmd-owner " "name"
+Matches if the packet was created by a process with the given command name.
+(this option is present only if iptables was compiled under a kernel
+supporting this feature)
diff --git a/extensions/libipt_physdev.man b/extensions/libipt_physdev.man
new file mode 100644
index 00000000..846ec7c1
--- /dev/null
+++ b/extensions/libipt_physdev.man
@@ -0,0 +1,42 @@
+This module matches on the bridge port input and output devices enslaved
+to a bridge device. This module is a part of the infrastructure that enables
+a transparent bridging IP firewall and is only useful for kernel versions
+above version 2.5.44.
+.TP
+.B --physdev-in name
+Name of a bridge port via which a packet is received (only for
+packets entering the
+.BR INPUT ,
+.B FORWARD
+and
+.B PREROUTING
+chains). If the interface name ends in a "+", then any
+interface which begins with this name will match. If the packet didn't arrive
+through a bridge device, this packet won't match this option, unless '!' is used.
+.TP
+.B --physdev-out name
+Name of a bridge port via which a packet is going to be sent (for packets
+entering the
+.BR FORWARD ,
+.B OUTPUT
+and
+.B POSTROUTING
+chains). If the interface name ends in a "+", then any
+interface which begins with this name will match. Note that in the
+.BR nat " and " mangle
+.B OUTPUT
+chains one cannot match on the bridge output port, however one can in the
+.B "filter OUTPUT"
+chain. If the packet won't leave by a bridge device or it is yet unknown what
+the output device will be, then the packet won't match this option, unless
+'!' is used.
+.TP
+.B --physdev-is-in
+Matches if the packet has entered through a bridge interface.
+.TP
+.B --physdev-is-out
+Matches if the packet will leave through a bridge interface.
+.TP
+.B --physdev-is-bridged
+Matches if the packet is being bridged and therefore is not being routed.
+This is only useful in the FORWARD and POSTROUTING chains.
diff --git a/extensions/libipt_pkttype.man b/extensions/libipt_pkttype.man
new file mode 100644
index 00000000..b52810b7
--- /dev/null
+++ b/extensions/libipt_pkttype.man
@@ -0,0 +1,3 @@
+This module matches the link-layer packet type.
+.TP
+.BI "--pkt-type " "[\fIunicast\fP|\fIbroadcast\fP|\fImulticast\fP]"
diff --git a/extensions/libipt_random.man b/extensions/libipt_random.man
new file mode 100644
index 00000000..f808a779
--- /dev/null
+++ b/extensions/libipt_random.man
@@ -0,0 +1,4 @@
+This module randomly matches a certain percentage of all packets.
+.TP
+.BI "--average " "percent"
+Matches the given percentage. If omitted, a probability of 50% is set.
diff --git a/extensions/libipt_realm.man b/extensions/libipt_realm.man
new file mode 100644
index 00000000..55e67fcf
--- /dev/null
+++ b/extensions/libipt_realm.man
@@ -0,0 +1,5 @@
+This matches the routing realm. Routing realms are used in complex routing
+setups involving dynamic routing protocols like BGP.
+.TP
+.BI "--realm " "[!]" "value[/mask]"
+Matches a given realm number (and optionally mask).
diff --git a/extensions/libipt_state.man b/extensions/libipt_state.man
new file mode 100644
index 00000000..71078680
--- /dev/null
+++ b/extensions/libipt_state.man
@@ -0,0 +1,21 @@
+This module, when combined with connection tracking, allows access to
+the connection tracking state for this packet.
+.TP
+.BI "--state " "state"
+Where state is a comma separated list of the connection states to
+match. Possible states are
+.B INVALID
+meaning that the packet could not be identified for some reason which
+includes running out of memory and ICMP errors which don't correspond to any
+known connection,
+.B ESTABLISHED
+meaning that the packet is associated with a connection which has seen
+packets in both directions,
+.B NEW
+meaning that the packet has started a new connection, or otherwise
+associated with a connection which has not seen packets in both
+directions, and
+.B RELATED
+meaning that the packet is starting a new connection, but is
+associated with an existing connection, such as an FTP data transfer,
+or an ICMP error.
diff --git a/extensions/libipt_tcp.man b/extensions/libipt_tcp.man
new file mode 100644
index 00000000..48a068fa
--- /dev/null
+++ b/extensions/libipt_tcp.man
@@ -0,0 +1,49 @@
+These extensions are loaded if `--protocol tcp' is specified. It
+provides the following options:
+.TP
+.BR "--source-port " "[!] \fIport\fP[:\fIport\fP]"
+Source port or port range specification. This can either be a service
+name or a port number. An inclusive range can also be specified,
+using the format
+.IR port : port .
+If the first port is omitted, "0" is assumed; if the last is omitted,
+"65535" is assumed.
+If the second port greater then the first they will be swapped.
+The flag
+.B --sport
+is a convenient alias for this option.
+.TP
+.BR "--destination-port " "[!] \fIport\fP[:\fIport\fP]"
+Destination port or port range specification. The flag
+.B --dport
+is a convenient alias for this option.
+.TP
+.BR "--tcp-flags " "[!] \fImask\fP \fIcomp\fP"
+Match when the TCP flags are as specified. The first argument is the
+flags which we should examine, written as a comma-separated list, and
+the second argument is a comma-separated list of flags which must be
+set. Flags are:
+.BR "SYN ACK FIN RST URG PSH ALL NONE" .
+Hence the command
+.nf
+ iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST SYN
+.fi
+will only match packets with the SYN flag set, and the ACK, FIN and
+RST flags unset.
+.TP
+.B "[!] --syn"
+Only match TCP packets with the SYN bit set and the ACK and RST bits
+cleared. Such packets are used to request TCP connection initiation;
+for example, blocking such packets coming in an interface will prevent
+incoming TCP connections, but outgoing TCP connections will be
+unaffected.
+It is equivalent to \fB--tcp-flags SYN,RST,ACK SYN\fP.
+If the "!" flag precedes the "--syn", the sense of the
+option is inverted.
+.TP
+.BR "--tcp-option " "[!] \fInumber\fP"
+Match if TCP option set.
+.TP
+.BR "--mss " "\fIvalue\fP[:\fIvalue\fP]"
+Match TCP SYN or SYN/ACK packets with the specified MSS value (or range),
+which control the maximum packet size for that connection.
diff --git a/extensions/libipt_tcpmss.man b/extensions/libipt_tcpmss.man
new file mode 100644
index 00000000..5115d6b9
--- /dev/null
+++ b/extensions/libipt_tcpmss.man
@@ -0,0 +1,4 @@
+This matches the TCP MSS (maximum segment size) field of the TCP header. You can only use this on TCP SYN or SYN/ACK packets, since the MSS is only negotiated during the TCP handshake at connection startup time.
+.TP
+.BI "[!] "--mss " "value[:value]"
+Match a given TCP MSS value or range.
diff --git a/extensions/libipt_time.man b/extensions/libipt_time.man
new file mode 100644
index 00000000..0871ecfa
--- /dev/null
+++ b/extensions/libipt_time.man
@@ -0,0 +1,10 @@
+This matches if the current time is within a given range.
+.TP
+.BI "--timestart " "value"
+Match only if it is after `value' (Format: HH:MM).
+.TP
+.BI "--timestop " "value"
+Match only if it is before `value' (Format: HH:MM).
+.TP
+.BI "--days " "listofdays"
+Match only if today is one of the given days. (Format: Mon,Tue,Wed,Thu,Fri)
diff --git a/extensions/libipt_tos.man b/extensions/libipt_tos.man
new file mode 100644
index 00000000..c612b299
--- /dev/null
+++ b/extensions/libipt_tos.man
@@ -0,0 +1,9 @@
+This module matches the 8 bits of Type of Service field in the IP
+header (ie. including the precedence bits).
+.TP
+.BI "--tos " "tos"
+The argument is either a standard name, (use
+.br
+ iptables -m tos -h
+.br
+to see the list), or a numeric value to match.
diff --git a/extensions/libipt_ttl.man b/extensions/libipt_ttl.man
new file mode 100644
index 00000000..f043c79a
--- /dev/null
+++ b/extensions/libipt_ttl.man
@@ -0,0 +1,10 @@
+This module matches the time to live field in the IP header.
+.TP
+.BI "--ttl-eq " "ttl"
+Matches the given TTL value.
+.TP
+.BI "--ttl-gt " "ttl"
+Matches if TTL is greater than the given TTL value.
+.TP
+.BI "--ttl-lt " "ttl"
+Matches if TTL is less than the given TTL value.
diff --git a/extensions/libipt_udp.man b/extensions/libipt_udp.man
new file mode 100644
index 00000000..04084797
--- /dev/null
+++ b/extensions/libipt_udp.man
@@ -0,0 +1,14 @@
+These extensions are loaded if `--protocol udp' is specified. It
+provides the following options:
+.TP
+.BR "--source-port " "[!] \fIport\fP[:\fIport\fP]"
+Source port or port range specification.
+See the description of the
+.B --source-port
+option of the TCP extension for details.
+.TP
+.BR "--destination-port " "[!] \fIport\fP[:\fIport\fP]"
+Destination port or port range specification.
+See the description of the
+.B --destination-port
+option of the TCP extension for details.
diff --git a/extensions/libipt_unclean.man b/extensions/libipt_unclean.man
new file mode 100644
index 00000000..3fecd554
--- /dev/null
+++ b/extensions/libipt_unclean.man
@@ -0,0 +1,2 @@
+This module takes no options, but attempts to match packets which seem
+malformed or unusual. This is regarded as experimental.