From 524bb803727baaad532915394ada06ec3eb8a11e Mon Sep 17 00:00:00 2001 From: Patrick McHardy Date: Sat, 19 Nov 2005 09:00:03 +0000 Subject: Add policy match extensions from patch-o-matic --- extensions/libipt_policy.man | 46 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 46 insertions(+) create mode 100644 extensions/libipt_policy.man (limited to 'extensions/libipt_policy.man') diff --git a/extensions/libipt_policy.man b/extensions/libipt_policy.man new file mode 100644 index 00000000..c2e81bed --- /dev/null +++ b/extensions/libipt_policy.man @@ -0,0 +1,46 @@ +This modules matches the policy used by IPsec for handling a packet. +.TP +.BI "--dir " "in|out" +Used to select whether to match the policy used for decapsulation or the +policy that will be used for encapsulation. +.B in +is valid in the +.B PREROUTING, INPUT and FORWARD +chains, +.B out +is valid in the +.B POSTROUTING, OUTPUT and FORWARD +chains. +.TP +.BI "--pol " "none|ipsec" +Matches if the packet is subject to IPsec processing. +.TP +.BI "--strict" +Selects whether to match the exact policy or match if any rule of +the policy matches the given policy. +.TP +.BI "--reqid " "id" +Matches the reqid of the policy rule. The reqid can be specified with +.B setkey(8) +using +.B unique:id +as level. +.TP +.BI "--spi " "spi" +Matches the SPI of the SA. +.TP +.BI "--proto " "ah|esp|ipcomp" +Matches the encapsulation protocol. +.TP +.BI "--mode " "tunnel|transport" +Matches the encapsulation mode. +.TP +.BI "--tunnel-src " "addr[/mask]" +Matches the source address of a tunnel. Only valid with --mode tunnel. +.TP +.BI "--tunnel-dst " "addr[/mask]" +Matches the destination address of a tunnel. Only valid with --mode tunnel. +.TP +.BI "--next" +Start the next element in the policy specification. Can only be used with +--strict -- cgit v1.2.3