From c2794131b445ebccba184066af6d3fb2f38d1f38 Mon Sep 17 00:00:00 2001 From: Henrik Nordstrom Date: Thu, 22 Jan 2004 15:04:24 +0000 Subject: split manpages into per-extension manpage snippet (Henrik Nordstrom) add lots of missing manpage snippets (Harald Welte) --- extensions/Makefile | 75 +++++++++++++++++++++++++++++++++++++++ extensions/libip6t_HL.man | 17 +++++++++ extensions/libip6t_LOG.man | 28 +++++++++++++++ extensions/libip6t_MARK.man | 6 ++++ extensions/libip6t_REJECT.man | 34 ++++++++++++++++++ extensions/libip6t_ROUTE.man | 12 +++++++ extensions/libip6t_TRACE.man | 3 ++ extensions/libip6t_ah.man | 3 ++ extensions/libip6t_condition.man | 4 +++ extensions/libip6t_dst.man | 7 ++++ extensions/libip6t_esp.man | 3 ++ extensions/libip6t_eui64.man | 1 + extensions/libip6t_frag.man | 19 ++++++++++ extensions/libip6t_fuzzy.man | 7 ++++ extensions/libip6t_hbh.man | 7 ++++ extensions/libip6t_hl.man | 10 ++++++ extensions/libip6t_icmpv6.man | 9 +++++ extensions/libip6t_ipv6header.man | 10 ++++++ extensions/libip6t_length.man | 4 +++ extensions/libip6t_limit.man | 15 ++++++++ extensions/libip6t_mac.man | 10 ++++++ extensions/libip6t_mark.man | 9 +++++ extensions/libip6t_multiport.man | 19 ++++++++++ extensions/libip6t_nth.man | 14 ++++++++ extensions/libip6t_owner.man | 21 +++++++++++ extensions/libip6t_random.man | 4 +++ extensions/libip6t_rt.man | 19 ++++++++++ extensions/libip6t_tcp.man | 45 +++++++++++++++++++++++ extensions/libip6t_udp.man | 14 ++++++++ extensions/libipt_BALANCE.man | 4 +++ extensions/libipt_CLASSIFY.man | 4 +++ extensions/libipt_CLUSTERIP.man | 24 +++++++++++++ extensions/libipt_CONNMARK.man | 13 +++++++ extensions/libipt_DNAT.man | 27 ++++++++++++++ extensions/libipt_DSCP.man | 9 +++++ extensions/libipt_ECN.man | 7 ++++ extensions/libipt_LOG.man | 28 +++++++++++++++ extensions/libipt_MARK.man | 6 ++++ extensions/libipt_MASQUERADE.man | 22 ++++++++++++ extensions/libipt_MIRROR.man | 12 +++++++ extensions/libipt_NETMAP.man | 9 +++++ extensions/libipt_NOTRACK.man | 5 +++ extensions/libipt_REDIRECT.man | 18 ++++++++++ extensions/libipt_REJECT.man | 34 ++++++++++++++++++ extensions/libipt_ROUTE.man | 15 ++++++++ extensions/libipt_SNAT.man | 26 ++++++++++++++ extensions/libipt_TCPMSS.man | 38 ++++++++++++++++++++ extensions/libipt_TOS.man | 11 ++++++ extensions/libipt_TRACE.man | 3 ++ extensions/libipt_TTL.man | 19 ++++++++++ extensions/libipt_ULOG.man | 27 ++++++++++++++ extensions/libipt_addrtype.man | 37 +++++++++++++++++++ extensions/libipt_ah.man | 3 ++ extensions/libipt_condition.man | 4 +++ extensions/libipt_conntrack.man | 49 +++++++++++++++++++++++++ extensions/libipt_dscp.man | 10 ++++++ extensions/libipt_dstlimit.man | 35 ++++++++++++++++++ extensions/libipt_ecn.man | 11 ++++++ extensions/libipt_esp.man | 3 ++ extensions/libipt_fuzzy.man | 7 ++++ extensions/libipt_helper.man | 11 ++++++ extensions/libipt_icmp.man | 9 +++++ extensions/libipt_iprange.man | 7 ++++ extensions/libipt_length.man | 4 +++ extensions/libipt_limit.man | 15 ++++++++ extensions/libipt_mac.man | 10 ++++++ extensions/libipt_mark.man | 9 +++++ extensions/libipt_mport.man | 19 ++++++++++ extensions/libipt_multiport.man | 19 ++++++++++ extensions/libipt_nth.man | 14 ++++++++ extensions/libipt_owner.man | 26 ++++++++++++++ extensions/libipt_physdev.man | 42 ++++++++++++++++++++++ extensions/libipt_pkttype.man | 3 ++ extensions/libipt_random.man | 4 +++ extensions/libipt_realm.man | 5 +++ extensions/libipt_state.man | 21 +++++++++++ extensions/libipt_tcp.man | 49 +++++++++++++++++++++++++ extensions/libipt_tcpmss.man | 4 +++ extensions/libipt_time.man | 10 ++++++ extensions/libipt_tos.man | 9 +++++ extensions/libipt_ttl.man | 10 ++++++ extensions/libipt_udp.man | 14 ++++++++ extensions/libipt_unclean.man | 2 ++ 83 files changed, 1265 insertions(+) create mode 100644 extensions/libip6t_HL.man create mode 100644 extensions/libip6t_LOG.man create mode 100644 extensions/libip6t_MARK.man create mode 100644 extensions/libip6t_REJECT.man create mode 100644 extensions/libip6t_ROUTE.man create mode 100644 extensions/libip6t_TRACE.man create mode 100644 extensions/libip6t_ah.man create mode 100644 extensions/libip6t_condition.man create mode 100644 extensions/libip6t_dst.man create mode 100644 extensions/libip6t_esp.man create mode 100644 extensions/libip6t_eui64.man create mode 100644 extensions/libip6t_frag.man create mode 100644 extensions/libip6t_fuzzy.man create mode 100644 extensions/libip6t_hbh.man create mode 100644 extensions/libip6t_hl.man create mode 100644 extensions/libip6t_icmpv6.man create mode 100644 extensions/libip6t_ipv6header.man create mode 100644 extensions/libip6t_length.man create mode 100644 extensions/libip6t_limit.man create mode 100644 extensions/libip6t_mac.man create mode 100644 extensions/libip6t_mark.man create mode 100644 extensions/libip6t_multiport.man create mode 100644 extensions/libip6t_nth.man create mode 100644 extensions/libip6t_owner.man create mode 100644 extensions/libip6t_random.man create mode 100644 extensions/libip6t_rt.man create mode 100644 extensions/libip6t_tcp.man create mode 100644 extensions/libip6t_udp.man create mode 100644 extensions/libipt_BALANCE.man create mode 100644 extensions/libipt_CLASSIFY.man create mode 100644 extensions/libipt_CLUSTERIP.man create mode 100644 extensions/libipt_CONNMARK.man create mode 100644 extensions/libipt_DNAT.man create mode 100644 extensions/libipt_DSCP.man create mode 100644 extensions/libipt_ECN.man create mode 100644 extensions/libipt_LOG.man create mode 100644 extensions/libipt_MARK.man create mode 100644 extensions/libipt_MASQUERADE.man create mode 100644 extensions/libipt_MIRROR.man create mode 100644 extensions/libipt_NETMAP.man create mode 100644 extensions/libipt_NOTRACK.man create mode 100644 extensions/libipt_REDIRECT.man create mode 100644 extensions/libipt_REJECT.man create mode 100644 extensions/libipt_ROUTE.man create mode 100644 extensions/libipt_SNAT.man create mode 100644 extensions/libipt_TCPMSS.man create mode 100644 extensions/libipt_TOS.man create mode 100644 extensions/libipt_TRACE.man create mode 100644 extensions/libipt_TTL.man create mode 100644 extensions/libipt_ULOG.man create mode 100644 extensions/libipt_addrtype.man create mode 100644 extensions/libipt_ah.man create mode 100644 extensions/libipt_condition.man create mode 100644 extensions/libipt_conntrack.man create mode 100644 extensions/libipt_dscp.man create mode 100644 extensions/libipt_dstlimit.man create mode 100644 extensions/libipt_ecn.man create mode 100644 extensions/libipt_esp.man create mode 100644 extensions/libipt_fuzzy.man create mode 100644 extensions/libipt_helper.man create mode 100644 extensions/libipt_icmp.man create mode 100644 extensions/libipt_iprange.man create mode 100644 extensions/libipt_length.man create mode 100644 extensions/libipt_limit.man create mode 100644 extensions/libipt_mac.man create mode 100644 extensions/libipt_mark.man create mode 100644 extensions/libipt_mport.man create mode 100644 extensions/libipt_multiport.man create mode 100644 extensions/libipt_nth.man create mode 100644 extensions/libipt_owner.man create mode 100644 extensions/libipt_physdev.man create mode 100644 extensions/libipt_pkttype.man create mode 100644 extensions/libipt_random.man create mode 100644 extensions/libipt_realm.man create mode 100644 extensions/libipt_state.man create mode 100644 extensions/libipt_tcp.man create mode 100644 extensions/libipt_tcpmss.man create mode 100644 extensions/libipt_time.man create mode 100644 extensions/libipt_tos.man create mode 100644 extensions/libipt_ttl.man create mode 100644 extensions/libipt_udp.man create mode 100644 extensions/libipt_unclean.man (limited to 'extensions') diff --git a/extensions/Makefile b/extensions/Makefile index db9d6041..2a45ea02 100644 --- a/extensions/Makefile +++ b/extensions/Makefile @@ -12,6 +12,29 @@ PF6_EXT_SLIB:=eui64 hl icmpv6 length limit mac mark multiport owner standard tcp PF_EXT_SLIB_OPTS:=$(foreach T,$(wildcard extensions/.*-test),$(shell KERNEL_DIR=$(KERNEL_DIR) $(T))) PF6_EXT_SLIB_OPTS:=$(foreach T,$(wildcard extensions/.*-test6),$(shell KERNEL_DIR=$(KERNEL_DIR) $(T))) +PF_EXT_ALL_SLIB:=$(patsubst extensions/libipt_%.c, %, $(wildcard extensions/libipt_*.c)) +PF6_EXT_ALL_SLIB:=$(patsubst extensions/libip6t_%.c, %, $(wildcard extensions/libipt_*.c)) + +PF_EXT_MAN_ALL_MATCHES:=$(foreach T,$(PF_EXT_ALL_SLIB),$(shell test -f extensions/libipt_$(T).man && grep -q register_match extensions/libipt_$(T).c && echo $(T))) +PF_EXT_MAN_ALL_TARGETS:=$(foreach T,$(PF_EXT_ALL_SLIB),$(shell test -f extensions/libipt_$(T).man && grep -q register_target extensions/libipt_$(T).c && echo $(T))) +PF6_EXT_MAN_ALL_MATCHES:=$(foreach T,$(PF6_EXT_ALL_SLIB),$(shell test -f extensions/libip6t_$(T).man && grep -q register_match6 extensions/libip6t_$(T).c && echo $(T))) +PF6_EXT_MAN_ALL_TARGETS:=$(foreach T,$(PF6_EXT_ALL_SLIB),$(shell test -f extensions/libip6t_$(T).man && grep -q register_target6 extensions/libip6t_$(T).c && echo $(T))) + +PF_EXT_MAN_MATCHES:=$(filter $(PF_EXT_ALL_SLIB), $(PF_EXT_MAN_ALL_MATCHES)) +PF_EXT_MAN_TARGETS:=$(filter $(PF_EXT_ALL_SLIB), $(PF_EXT_MAN_ALL_TARGETS)) +PF_EXT_MAN_EXTRA_MATCHES:=$(filter-out $(PF_EXT_MAN_MATCHES), $(PF_EXT_MAN_ALL_MATCHES)) +PF_EXT_MAN_EXTRA_TARGETS:=$(filter-out $(PF_EXT_MAN_TARGETS), $(PF_EXT_MAN_ALL_TARGETS)) +PF6_EXT_MAN_MATCHES:=$(filter $(PF6_EXT_ALL_SLIB), $(PF6_EXT_MAN_ALL_MATCHES)) +PF6_EXT_MAN_TARGETS:=$(filter $(PF6_EXT_ALL_SLIB), $(PF6_EXT_MAN_ALL_TARGETS)) +PF6_EXT_MAN_EXTRA_MATCHES:=$(filter-out $(PF6_EXT_MAN_MATCHES), $(PF6_EXT_MAN_ALL_MATCHES)) +PF6_EXT_MAN_EXTRA_TARGETS:=$(filter-out $(PF6_EXT_MAN_TARGETS), $(PF6_EXT_MAN_ALL_TARGETS)) + + +allman: + @echo ALL_SLIB: $(PF_EXT_ALL_SLIB) + @echo ALL_MATCH: $(PF_EXT_MAN_ALL_MATCHES) + @echo ALL_TARGET: $(PF_EXT_MAN_ALL_TARGETS) + PF_EXT_SLIB+=$(PF_EXT_SLIB_OPTS) PF6_EXT_SLIB+=$(PF6_EXT_SLIB_OPTS) @@ -79,6 +102,58 @@ extensions/lib%.o: extensions/lib%.c endif +EXTRAS += extensions/libipt_targets.man +extensions/libipt_targets.man: $(patsubst %,extensions/libipt_%.man,$(PF_EXT_MAN_ALL_TARGETS)) + @for ext in $(PF_EXT_MAN_TARGETS); do \ + echo ".SS $$ext" ;\ + cat extensions/libipt_$$ext.man ;\ + done >extensions/libipt_targets.man + @if [ -n "$(PF_EXT_MAN_EXTRA_TARGETS)" ]; then \ + for ext in $(PF_EXT_MAN_EXTRA_TARGETS); do \ + echo ".SS $$ext (not supported, see Patch-O-Matic)" ;\ + cat extensions/libipt_$$ext.man ;\ + done ;\ + fi >>extensions/libipt_targets.man + +EXTRAS += extensions/libipt_matches.man +extensions/libipt_matches.man: $(patsubst %,extensions/libipt_%.man,$(PF_EXT_MAN_ALL_MATCHES)) + @for ext in $(PF_EXT_MAN_MATCHES); do \ + echo ".SS $$ext" ;\ + cat extensions/libipt_$$ext.man ;\ + done >extensions/libipt_matches.man + @if [ -n "$(PF_EXT_MAN_EXTRA_MATCHES)" ]; then \ + for ext in $(PF_EXT_MAN_EXTRA_MATCHES); do \ + echo ".SS $$ext (not supported, see Patch-O-Matic)" ;\ + cat extensions/libipt_$$ext.man ;\ + done ;\ + fi >>extensions/libipt_matches.man + +EXTRAS += extensions/libip6t_targets.man +extensions/libip6t_targets.man: $(patsubst %, extensions/libip6t_%.man, $(PF6_EXT_MAN_ALL_TARGETS)) + @for ext in $(PF6_EXT_MAN_TARGETS); do \ + echo ".SS $$ext" ;\ + cat extensions/libip6t_$$ext.man ;\ + done >extensions/libip6t_targets.man + @if [ -n "$(PF6_EXT_MAN_EXTRA_TARGETS)" ]; then \ + for ext in $(PF6_EXT_MAN_EXTRA_TARGETS); do \ + echo ".SS $$ext (not supported, see Patch-O-Matic)" ;\ + cat extensions/libip6t_$$ext.man ;\ + done ;\ + fi >>extensions/libip6t_targets.man + +EXTRAS += extensions/libip6t_matches.man +extensions/libip6t_matches.man: $(patsubst %, extensions/libip6t_%.man, $(PF6_EXT_MAN_ALL_MATCHES)) + @for ext in $(PF6_EXT_MAN_MATCHES); do \ + echo ".SS $$ext" ;\ + cat extensions/libip6t_$$ext.man ;\ + done >extensions/libip6t_matches.man + @if [ -n "$(PF6_EXT_MAN_EXTRA_MATCHES)" ]; then \ + for ext in $(PF6_EXT_MAN_EXTRA_MATCHES); do \ + echo ".SS $$ext (not supported, see Patch-O-Matic)" ;\ + cat extensions/libip6t_$$ext.man ;\ + done ;\ + fi >>extensions/libip6t_matches.man + $(DESTDIR)$(LIBDIR)/iptables/libipt_%.so: extensions/libipt_%.so @[ -d $(DESTDIR)$(LIBDIR)/iptables ] || mkdir -p $(DESTDIR)$(LIBDIR)/iptables cp $< $@ diff --git a/extensions/libip6t_HL.man b/extensions/libip6t_HL.man new file mode 100644 index 00000000..6b8291d9 --- /dev/null +++ b/extensions/libip6t_HL.man @@ -0,0 +1,17 @@ +This is used to modify the IPv6 HOPLIMIT header field. The HOPLIMIT field is +similar to what is known as TTL value in IPv4. Setting or incrementing the +HOPLIMIT field can potentially be very dangerous, so it should be avoided at +any cost. +.TP +.B Don't ever set or increment the value on packets that leave your local network! +.B mangle +table. +.TP +.BI "--hl-set " "value" +Set the HOPLIMIT value to `value'. +.TP +.BI "--hl-dec " "value" +Decrement the HOPLIMIT value `value' times. +.TP +.BI "--hl-inc " "value" +Increment the HOPLIMIT value `value' times. diff --git a/extensions/libip6t_LOG.man b/extensions/libip6t_LOG.man new file mode 100644 index 00000000..9eb5a6ab --- /dev/null +++ b/extensions/libip6t_LOG.man @@ -0,0 +1,28 @@ +Turn on kernel logging of matching packets. When this option is set +for a rule, the Linux kernel will print some information on all +matching packets (like most IPv6 IPv6-header fields) via the kernel log +(where it can be read with +.I dmesg +or +.IR syslogd (8)). +This is a "non-terminating target", i.e. rule traversal continues at +the next rule. So if you want to LOG the packets you refuse, use two +separate rules with the same matching criteria, first using target LOG +then DROP (or REJECT). +.TP +.BI "--log-level " "level" +Level of logging (numeric or see \fIsyslog.conf\fP(5)). +.TP +.BI "--log-prefix " "prefix" +Prefix log messages with the specified prefix; up to 29 letters long, +and useful for distinguishing messages in the logs. +.TP +.B --log-tcp-sequence +Log TCP sequence numbers. This is a security risk if the log is +readable by users. +.TP +.B --log-tcp-options +Log options from the TCP packet header. +.TP +.B --log-ip-options +Log options from the IPv6 packet header. diff --git a/extensions/libip6t_MARK.man b/extensions/libip6t_MARK.man new file mode 100644 index 00000000..1f3260c5 --- /dev/null +++ b/extensions/libip6t_MARK.man @@ -0,0 +1,6 @@ +This is used to set the netfilter mark value associated with the +packet. It is only valid in the +.B mangle +table. +.TP +.BI "--set-mark " "mark" diff --git a/extensions/libip6t_REJECT.man b/extensions/libip6t_REJECT.man new file mode 100644 index 00000000..75930f1e --- /dev/null +++ b/extensions/libip6t_REJECT.man @@ -0,0 +1,34 @@ +This is used to send back an error packet in response to the matched +packet: otherwise it is equivalent to +.B DROP +so it is a terminating TARGET, ending rule traversal. +This target is only valid in the +.BR INPUT , +.B FORWARD +and +.B OUTPUT +chains, and user-defined chains which are only called from those +chains. The following option controls the nature of the error packet +returned: +.TP +.BI "--reject-with " "type" +The type given can be +.nf +.B " icmp6-no-route" +.B " no-route" +.B " icmp6-adm-prohibited" +.B " adm-prohibited" +.B " icmp6-addr-unreachable" +.B " addr-unreach" +.B " icmp6-port-unreachable" +.B " port-unreach" +.fi +which return the appropriate IPv6-ICMP error message (\fBport-unreach\fP is +the default). Finally, the option +.B tcp-reset +can be used on rules which only match the TCP protocol: this causes a +TCP RST packet to be sent back. This is mainly useful for blocking +.I ident +(113/tcp) probes which frequently occur when sending mail to broken mail +hosts (which won't accept your mail otherwise). + diff --git a/extensions/libip6t_ROUTE.man b/extensions/libip6t_ROUTE.man new file mode 100644 index 00000000..145d748d --- /dev/null +++ b/extensions/libip6t_ROUTE.man @@ -0,0 +1,12 @@ +This is used to explicitly override the core network stack's routing decision. +.B mangle +table. +.TP +.BI "--oif " "ifname" +Route the packet through `ifname' network interface +.TP +.BI "--gw " "IPv6_address" +Route the packet via this gateway +.TP +.BI "--continue " +Behave like a non-terminating target and continue traversing the rules diff --git a/extensions/libip6t_TRACE.man b/extensions/libip6t_TRACE.man new file mode 100644 index 00000000..549ab33b --- /dev/null +++ b/extensions/libip6t_TRACE.man @@ -0,0 +1,3 @@ +This target has no options. It just turns on +.B packet tracing +for all packets that match this rule. diff --git a/extensions/libip6t_ah.man b/extensions/libip6t_ah.man new file mode 100644 index 00000000..97de1e19 --- /dev/null +++ b/extensions/libip6t_ah.man @@ -0,0 +1,3 @@ +This module matches the SPIs in AH header of IPSec packets. +.TP +.BR "--ahspi " "[!] \fIspi\fP[:\fIspi\fP]" diff --git a/extensions/libip6t_condition.man b/extensions/libip6t_condition.man new file mode 100644 index 00000000..30c478cd --- /dev/null +++ b/extensions/libip6t_condition.man @@ -0,0 +1,4 @@ +This matches if a specific /proc filename is '0' or '1'. +.TP +.BI "--condition " "[!] filename" +Match on boolean value stored in /proc/net/ip6t_condition/filename file diff --git a/extensions/libip6t_dst.man b/extensions/libip6t_dst.man new file mode 100644 index 00000000..168a10fb --- /dev/null +++ b/extensions/libip6t_dst.man @@ -0,0 +1,7 @@ +This module matches the IPv6 destination header options +.TP +.BI "--dst-len" "[!]" "length" +Total length of this header +.TP +.BI "--dst-opts " "TYPE[:LEN],[,TYPE[:LEN]...]" +Options and it's length (List). diff --git a/extensions/libip6t_esp.man b/extensions/libip6t_esp.man new file mode 100644 index 00000000..7b84368d --- /dev/null +++ b/extensions/libip6t_esp.man @@ -0,0 +1,3 @@ +This module matches the SPIs in ESP header of IPSec packets. +.TP +.BR "--espspi " "[!] \fIspi\fP[:\fIspi\fP]" diff --git a/extensions/libip6t_eui64.man b/extensions/libip6t_eui64.man new file mode 100644 index 00000000..24fc56c6 --- /dev/null +++ b/extensions/libip6t_eui64.man @@ -0,0 +1 @@ +This module matches the EUI64 part of a stateless autoconfigured IPv6 address. It compares the source MAC address with the lower 64 bits of the IPv6 address. diff --git a/extensions/libip6t_frag.man b/extensions/libip6t_frag.man new file mode 100644 index 00000000..fff3db3b --- /dev/null +++ b/extensions/libip6t_frag.man @@ -0,0 +1,19 @@ +This module matches the time IPv6 fragmentathion header +.TP +.BI "--fragid " "[!]" "id[:id]" +Matches the given fragmentation ID (range). +.TP +.BI "--fraglen " "[!]" "length" +Matches the total length of this header. +.TP +.BI "--fragres " +Matches the reserved field, too. +.TP +.BI "--fragfirst " +Matches on the first fragment. +.TP +.BI "[--fragmore]" +Matches if there are more fragments. +.TP +.BI "[--fraglast]" +Matches if this is the last fragement. diff --git a/extensions/libip6t_fuzzy.man b/extensions/libip6t_fuzzy.man new file mode 100644 index 00000000..270c8d62 --- /dev/null +++ b/extensions/libip6t_fuzzy.man @@ -0,0 +1,7 @@ +This module matches a rate limit based on a fuzzy logic controller [FLC] +.TP +.BI "--lower-limit "number" +Specifies the lower limit (in packets per second). +.TP +.BI "--upper-limit " "number" +Specifies the upper limit (in packets per second). diff --git a/extensions/libip6t_hbh.man b/extensions/libip6t_hbh.man new file mode 100644 index 00000000..8376f915 --- /dev/null +++ b/extensions/libip6t_hbh.man @@ -0,0 +1,7 @@ +This module matches the IPv6 hop-by-hop header options +.TP +.BI "--hbh-len" "[!]" "length" +Total length of this header +.TP +.BI "--hbh-opts " "TYPE[:LEN],[,TYPE[:LEN]...]" +Options and it's length (List). diff --git a/extensions/libip6t_hl.man b/extensions/libip6t_hl.man new file mode 100644 index 00000000..9fcb730d --- /dev/null +++ b/extensions/libip6t_hl.man @@ -0,0 +1,10 @@ +This module matches the HOPLIMIT field in the IPv6 header. +.TP +.BI "--hl-eq " "value" +Matches if HOPLIMIT equals the given value. +.TP +.BI "--hl-lt " "ttl" +Matches if HOPLIMIT is less than the given value. +.TP +.BI "--hl-gt " "ttl" +Matches if HOPLIMIT is greater than the given value. diff --git a/extensions/libip6t_icmpv6.man b/extensions/libip6t_icmpv6.man new file mode 100644 index 00000000..27029544 --- /dev/null +++ b/extensions/libip6t_icmpv6.man @@ -0,0 +1,9 @@ +This extension is loaded if `--protocol ipv6-icmp' or `--protocol icmpv6' is +specified. It provides the following option: +.TP +.BR "--icmpv6-type " "[!] \fItypename\fP" +This allows specification of the ICMP type, which can be a numeric +IPv6-ICMP type, or one of the IPv6-ICMP type names shown by the command +.nf + ip6tables -p ipv6-icmp -h +.fi diff --git a/extensions/libip6t_ipv6header.man b/extensions/libip6t_ipv6header.man new file mode 100644 index 00000000..bec3e184 --- /dev/null +++ b/extensions/libip6t_ipv6header.man @@ -0,0 +1,10 @@ +This module matches on IPv6 option headers +.TP +.BI "--header " "[!]" "headers" +Matches the given type of headers. +Names: hop,dst,route,frag,auth,esp,none,proto +Long Names: hop-by-hop,ipv6-opts,ipv6-route,ipv6-frag,ah,esp,ipv6-nonxt,protocol +Numbers: 0,60,43,44,51,50,59 +.TP +.BI "--soft" +The header CONTAINS the specified extensions. diff --git a/extensions/libip6t_length.man b/extensions/libip6t_length.man new file mode 100644 index 00000000..72a6b5dc --- /dev/null +++ b/extensions/libip6t_length.man @@ -0,0 +1,4 @@ +This module matches the length of a packet against a specific value +or range of values. +.TP +.BR "--length " "\fIlength\fP[:\fIlength\fP]" diff --git a/extensions/libip6t_limit.man b/extensions/libip6t_limit.man new file mode 100644 index 00000000..84b63d4e --- /dev/null +++ b/extensions/libip6t_limit.man @@ -0,0 +1,15 @@ +This module matches at a limited rate using a token bucket filter. +A rule using this extension will match until this limit is reached +(unless the `!' flag is used). It can be used in combination with the +.B LOG +target to give limited logging, for example. +.TP +.BI "--limit " "rate" +Maximum average matching rate: specified as a number, with an optional +`/second', `/minute', `/hour', or `/day' suffix; the default is +3/hour. +.TP +.BI "--limit-burst " "number" +Maximum initial number of packets to match: this number gets +recharged by one every time the limit specified above is not reached, +up to this number; the default is 5. diff --git a/extensions/libip6t_mac.man b/extensions/libip6t_mac.man new file mode 100644 index 00000000..5321ca1c --- /dev/null +++ b/extensions/libip6t_mac.man @@ -0,0 +1,10 @@ +.TP +.BR "--mac-source " "[!] \fIaddress\fP" +Match source MAC address. It must be of the form XX:XX:XX:XX:XX:XX. +Note that this only makes sense for packets coming from an Ethernet device +and entering the +.BR PREROUTING , +.B FORWARD +or +.B INPUT +chains. diff --git a/extensions/libip6t_mark.man b/extensions/libip6t_mark.man new file mode 100644 index 00000000..05f8e1ec --- /dev/null +++ b/extensions/libip6t_mark.man @@ -0,0 +1,9 @@ +This module matches the netfilter mark field associated with a packet +(which can be set using the +.B MARK +target below). +.TP +.BR "--mark " "\fIvalue\fP[/\fImask\fP]" +Matches packets with the given unsigned mark value (if a mask is +specified, this is logically ANDed with the mask before the +comparison). diff --git a/extensions/libip6t_multiport.man b/extensions/libip6t_multiport.man new file mode 100644 index 00000000..cead84e7 --- /dev/null +++ b/extensions/libip6t_multiport.man @@ -0,0 +1,19 @@ +This module matches a set of source or destination ports. Up to 15 +ports can be specified. It can only be used in conjunction with +.B "-p tcp" +or +.BR "-p udp" . +.TP +.BR "--source-ports " "\fIport\fP[,\fIport\fP[,\fIport\fP...]]" +Match if the source port is one of the given ports. The flag +.B --sports +is a convenient alias for this option. +.TP +.BR "--destination-ports " "\fIport\fP[,\fIport\fP[,\fIport\fP...]]" +Match if the destination port is one of the given ports. The flag +.B --dports +is a convenient alias for this option. +.TP +.BR "--ports " "\fIport\fP[,\fIport\fP[,\fIport\fP...]]" +Match if the both the source and destination ports are equal to each +other and to one of the given ports. diff --git a/extensions/libip6t_nth.man b/extensions/libip6t_nth.man new file mode 100644 index 00000000..d215fd55 --- /dev/null +++ b/extensions/libip6t_nth.man @@ -0,0 +1,14 @@ +This module matches every `n'th packet +.TP +.BI "--every " "value" +Match every `value' packet +.TP +.BI "[" "--counter " "num" "]" +Use internal counter number `num'. Default is `0'. +.TP +.BI "[" "--start " "num" "]" +Initialize the counter at the number `num' insetad of `0'. Most between `0' +and `value'-1. +.TP +.BI "[" "--packet " "num" "]" +Match on `num' packet. Most be between `0' and `value'-1. diff --git a/extensions/libip6t_owner.man b/extensions/libip6t_owner.man new file mode 100644 index 00000000..8a31ca40 --- /dev/null +++ b/extensions/libip6t_owner.man @@ -0,0 +1,21 @@ +This module attempts to match various characteristics of the packet +creator, for locally-generated packets. It is only valid in the +.B OUTPUT +chain, and even this some packets (such as ICMP ping responses) may +have no owner, and hence never match. This is regarded as experimental. +.TP +.BI "--uid-owner " "userid" +Matches if the packet was created by a process with the given +effective user id. +.TP +.BI "--gid-owner " "groupid" +Matches if the packet was created by a process with the given +effective group id. +.TP +.BI "--pid-owner " "processid" +Matches if the packet was created by a process with the given +process id. +.TP +.BI "--sid-owner " "sessionid" +Matches if the packet was created by a process in the given session +group. diff --git a/extensions/libip6t_random.man b/extensions/libip6t_random.man new file mode 100644 index 00000000..f808a779 --- /dev/null +++ b/extensions/libip6t_random.man @@ -0,0 +1,4 @@ +This module randomly matches a certain percentage of all packets. +.TP +.BI "--average " "percent" +Matches the given percentage. If omitted, a probability of 50% is set. diff --git a/extensions/libip6t_rt.man b/extensions/libip6t_rt.man new file mode 100644 index 00000000..4347ecd1 --- /dev/null +++ b/extensions/libip6t_rt.man @@ -0,0 +1,19 @@ +Match on IPv6 routing header +.TP +.BI "--rt-type " "[!]" "type" +Match the type (numeric). +.TP +.BI "--rt-segsleft" "[!]" "num[:num]" +Match the `segments left' field (range). +.TP +.BI "--rt-len" "[!]" "length" +Match the length of this header +.TP +.BI "--rt-0-res" +Match the reserved field, too (type=0) +.TP +.BI "--rt-0-addrs ADDR[,ADDR...] +Match type=0 addresses (list). +.TP +.BI "--rt-0-not-strict" +List of type=0 addresses is not a strict list. diff --git a/extensions/libip6t_tcp.man b/extensions/libip6t_tcp.man new file mode 100644 index 00000000..75d172e1 --- /dev/null +++ b/extensions/libip6t_tcp.man @@ -0,0 +1,45 @@ +These extensions are loaded if `--protocol tcp' is specified. It +provides the following options: +.TP +.BR "--source-port " "[!] \fIport\fP[:\fIport\fP]" +Source port or port range specification. This can either be a service +name or a port number. An inclusive range can also be specified, +using the format +.IR port : port . +If the first port is omitted, "0" is assumed; if the last is omitted, +"65535" is assumed. +If the second port greater then the first they will be swapped. +The flag +.B --sport +is a convenient alias for this option. +.TP +.BR "--destination-port " "[!] \fIport\fP[:\fIport\fP]" +Destination port or port range specification. The flag +.B --dport +is a convenient alias for this option. +.TP +.BR "--tcp-flags " "[!] \fImask\fP \fIcomp\fP" +Match when the TCP flags are as specified. The first argument is the +flags which we should examine, written as a comma-separated list, and +the second argument is a comma-separated list of flags which must be +set. Flags are: +.BR "SYN ACK FIN RST URG PSH ALL NONE" . +Hence the command +.nf + ip6tables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST SYN +.fi +will only match packets with the SYN flag set, and the ACK, FIN and +RST flags unset. +.TP +.B "[!] --syn" +Only match TCP packets with the SYN bit set and the ACK and RST bits +cleared. Such packets are used to request TCP connection initiation; +for example, blocking such packets coming in an interface will prevent +incoming TCP connections, but outgoing TCP connections will be +unaffected. +It is equivalent to \fB--tcp-flags SYN,RST,ACK SYN\fP. +If the "!" flag precedes the "--syn", the sense of the +option is inverted. +.TP +.BR "--tcp-option " "[!] \fInumber\fP" +Match if TCP option set. diff --git a/extensions/libip6t_udp.man b/extensions/libip6t_udp.man new file mode 100644 index 00000000..04084797 --- /dev/null +++ b/extensions/libip6t_udp.man @@ -0,0 +1,14 @@ +These extensions are loaded if `--protocol udp' is specified. It +provides the following options: +.TP +.BR "--source-port " "[!] \fIport\fP[:\fIport\fP]" +Source port or port range specification. +See the description of the +.B --source-port +option of the TCP extension for details. +.TP +.BR "--destination-port " "[!] \fIport\fP[:\fIport\fP]" +Destination port or port range specification. +See the description of the +.B --destination-port +option of the TCP extension for details. diff --git a/extensions/libipt_BALANCE.man b/extensions/libipt_BALANCE.man new file mode 100644 index 00000000..0eb09d07 --- /dev/null +++ b/extensions/libipt_BALANCE.man @@ -0,0 +1,4 @@ +This allows you to DNAT connections in a round-robin way over a given range of destination addresses. +.TP +.BI "--to-destination " "ipaddr-ipaddr" +Address range to round-robin over. diff --git a/extensions/libipt_CLASSIFY.man b/extensions/libipt_CLASSIFY.man new file mode 100644 index 00000000..393c329e --- /dev/null +++ b/extensions/libipt_CLASSIFY.man @@ -0,0 +1,4 @@ +This module allows you to set the skb->priority value (and thus classify the packet into a specific CBQ class). +.TP +.BI "--set-class " "MAJOR:MINOR" +Set the major and minor class value. diff --git a/extensions/libipt_CLUSTERIP.man b/extensions/libipt_CLUSTERIP.man new file mode 100644 index 00000000..8e766f37 --- /dev/null +++ b/extensions/libipt_CLUSTERIP.man @@ -0,0 +1,24 @@ +This module allows you to configure a simple cluster of nodes that share +a certain IP and MAC address without an explicit load balancer in front of +them. Connections are statically distributed between the nodes in this +cluster. +.TP +.BI "--new " +Create a new ClusterIP. You always have to set this on the first rule +for a given ClusterIP. +.TP +.BI "--hashmode " "mode" +Specify the hashing mode. Has to be one of +.B sourceip, sourceip-sourceport, sourceip-sourceport-destport +.TP +.BI "--clustermac " "mac" +Specify the ClusterIP MAC address. Has to be a link-layer multicast address +.TP +.BI "--total-nodes " "num" +Number of total nodes within this cluster. +.TP +.BI "--local-node " "num" +Local node number within this cluster. +.TP +.BI "--hash-init " "rnd" +Specify the random seed used for hash initialization. diff --git a/extensions/libipt_CONNMARK.man b/extensions/libipt_CONNMARK.man new file mode 100644 index 00000000..64a0222d --- /dev/null +++ b/extensions/libipt_CONNMARK.man @@ -0,0 +1,13 @@ +This target allows you to mark that connection with an arbitrary walue. This +value can later be matched via the +.B connmark +match. +.TP +.BI "--set-mark " "mark" +Set the conntrack mark, +.TP +.BI "--save-mark" +Save the packet nfmark on the connection mark. +.TP +.BI "--restore-mark" +Restore the saved nfmark value from the connection mark. diff --git a/extensions/libipt_DNAT.man b/extensions/libipt_DNAT.man new file mode 100644 index 00000000..7579e14e --- /dev/null +++ b/extensions/libipt_DNAT.man @@ -0,0 +1,27 @@ +This target is only valid in the +.B nat +table, in the +.B PREROUTING +and +.B OUTPUT +chains, and user-defined chains which are only called from those +chains. It specifies that the destination address of the packet +should be modified (and all future packets in this connection will +also be mangled), and rules should cease being examined. It takes one +type of option: +.TP +.BR "--to-destination " "\fIipaddr\fP[-\fIipaddr\fP][:\fIport\fP-\fIport\fP]" +which can specify a single new destination IP address, an inclusive +range of IP addresses, and optionally, a port range (which is only +valid if the rule also specifies +.B "-p tcp" +or +.BR "-p udp" ). +If no port range is specified, then the destination port will never be +modified. +.RS +.PP +You can add several --to-destination options. If you specify more +than one destination address, either via an address range or multiple +--to-destination options, a simple round-robin (one after another in +cycle) load balancing takes place between these adresses. diff --git a/extensions/libipt_DSCP.man b/extensions/libipt_DSCP.man new file mode 100644 index 00000000..e8e5cf5b --- /dev/null +++ b/extensions/libipt_DSCP.man @@ -0,0 +1,9 @@ +This target allows to alter the value of the DSCP bits within the TOS +header of the IPv4 packet. As this manipulates a packet, it can only +be used in the mangle table. +.TP +.BI "--set-dscp " "value" +Set the DSCP field to a numerical value (can be decimal or hex) +.TP +.BI "--set-dscp-class " "class" +Set the DSCP field to a DiffServ class. diff --git a/extensions/libipt_ECN.man b/extensions/libipt_ECN.man new file mode 100644 index 00000000..3668490b --- /dev/null +++ b/extensions/libipt_ECN.man @@ -0,0 +1,7 @@ +This target allows to selectively work around known ECN blackholes. +It can only be used in the mangle table. +.TP +.BI "--ecn-tcp-remove" +Remove all ECN bits from the TCP header. Of course, it can only be used +in conjunction with +.BR "-p tcp" . diff --git a/extensions/libipt_LOG.man b/extensions/libipt_LOG.man new file mode 100644 index 00000000..c604c76c --- /dev/null +++ b/extensions/libipt_LOG.man @@ -0,0 +1,28 @@ +Turn on kernel logging of matching packets. When this option is set +for a rule, the Linux kernel will print some information on all +matching packets (like most IP header fields) via the kernel log +(where it can be read with +.I dmesg +or +.IR syslogd (8)). +This is a "non-terminating target", i.e. rule traversal continues at +the next rule. So if you want to LOG the packets you refuse, use two +separate rules with the same matching criteria, first using target LOG +then DROP (or REJECT). +.TP +.BI "--log-level " "level" +Level of logging (numeric or see \fIsyslog.conf\fP(5)). +.TP +.BI "--log-prefix " "prefix" +Prefix log messages with the specified prefix; up to 29 letters long, +and useful for distinguishing messages in the logs. +.TP +.B --log-tcp-sequence +Log TCP sequence numbers. This is a security risk if the log is +readable by users. +.TP +.B --log-tcp-options +Log options from the TCP packet header. +.TP +.B --log-ip-options +Log options from the IP packet header. diff --git a/extensions/libipt_MARK.man b/extensions/libipt_MARK.man new file mode 100644 index 00000000..1c47e97a --- /dev/null +++ b/extensions/libipt_MARK.man @@ -0,0 +1,6 @@ +This is used to set the netfilter mark value associated with the +packet. It is only valid in the +.B mangle +table. It can for example be used in conjunction with iproute2. +.TP +.BI "--set-mark " "mark" diff --git a/extensions/libipt_MASQUERADE.man b/extensions/libipt_MASQUERADE.man new file mode 100644 index 00000000..e82063cc --- /dev/null +++ b/extensions/libipt_MASQUERADE.man @@ -0,0 +1,22 @@ +This target is only valid in the +.B nat +table, in the +.B POSTROUTING +chain. It should only be used with dynamically assigned IP (dialup) +connections: if you have a static IP address, you should use the SNAT +target. Masquerading is equivalent to specifying a mapping to the IP +address of the interface the packet is going out, but also has the +effect that connections are +.I forgotten +when the interface goes down. This is the correct behavior when the +next dialup is unlikely to have the same interface address (and hence +any established connections are lost anyway). It takes one option: +.TP +.BR "--to-ports " "\fIport\fP[-\fIport\fP]" +This specifies a range of source ports to use, overriding the default +.B SNAT +source port-selection heuristics (see above). This is only valid +if the rule also specifies +.B "-p tcp" +or +.BR "-p udp" . diff --git a/extensions/libipt_MIRROR.man b/extensions/libipt_MIRROR.man new file mode 100644 index 00000000..7b720bcb --- /dev/null +++ b/extensions/libipt_MIRROR.man @@ -0,0 +1,12 @@ +This is an experimental demonstration target which inverts the source +and destination fields in the IP header and retransmits the packet. +It is only valid in the +.BR INPUT , +.B FORWARD +and +.B PREROUTING +chains, and user-defined chains which are only called from those +chains. Note that the outgoing packets are +.B NOT +seen by any packet filtering chains, connection tracking or NAT, to +avoid loops and other problems. diff --git a/extensions/libipt_NETMAP.man b/extensions/libipt_NETMAP.man new file mode 100644 index 00000000..d49a025d --- /dev/null +++ b/extensions/libipt_NETMAP.man @@ -0,0 +1,9 @@ +This target allows you to statically map a whole network of addresses onto +another network of addresses. It can only be used from rules in the +.B nat +table. +.TP +.BI "--to " "address[/mask]" +Network address to map to. The resulting address will be constructed in the +following way: All 'one' bits in the mask are filled in from the new `address'. +All bits that are zero in the mask are filled in from the original address. diff --git a/extensions/libipt_NOTRACK.man b/extensions/libipt_NOTRACK.man new file mode 100644 index 00000000..30e830ad --- /dev/null +++ b/extensions/libipt_NOTRACK.man @@ -0,0 +1,5 @@ +This target disables connection tracking for all packets matching that rule. +.TP +It can only be used in the +.B raw +table. diff --git a/extensions/libipt_REDIRECT.man b/extensions/libipt_REDIRECT.man new file mode 100644 index 00000000..19fa917c --- /dev/null +++ b/extensions/libipt_REDIRECT.man @@ -0,0 +1,18 @@ +This target is only valid in the +.B nat +table, in the +.B PREROUTING +and +.B OUTPUT +chains, and user-defined chains which are only called from those +chains. It alters the destination IP address to send the packet to +the machine itself (locally-generated packets are mapped to the +127.0.0.1 address). It takes one option: +.TP +.BR "--to-ports " "\fIport\fP[-\fIport\fP]" +This specifies a destination port or range of ports to use: without +this, the destination port is never altered. This is only valid +if the rule also specifies +.B "-p tcp" +or +.BR "-p udp" . diff --git a/extensions/libipt_REJECT.man b/extensions/libipt_REJECT.man new file mode 100644 index 00000000..174bf7b3 --- /dev/null +++ b/extensions/libipt_REJECT.man @@ -0,0 +1,34 @@ +This is used to send back an error packet in response to the matched +packet: otherwise it is equivalent to +.B DROP +so it is a terminating TARGET, ending rule traversal. +This target is only valid in the +.BR INPUT , +.B FORWARD +and +.B OUTPUT +chains, and user-defined chains which are only called from those +chains. The following option controls the nature of the error packet +returned: +.TP +.BI "--reject-with " "type" +The type given can be +.nf +.B " icmp-net-unreachable" +.B " icmp-host-unreachable" +.B " icmp-port-unreachable" +.B " icmp-proto-unreachable" +.B " icmp-net-prohibited" +.B " icmp-host-prohibited or" +.B " icmp-admin-prohibited (*)" +.fi +which return the appropriate ICMP error message (\fBport-unreachable\fP is +the default). The option +.B tcp-reset +can be used on rules which only match the TCP protocol: this causes a +TCP RST packet to be sent back. This is mainly useful for blocking +.I ident +(113/tcp) probes which frequently occur when sending mail to broken mail +hosts (which won't accept your mail otherwise). +.TP +(*) Using icmp-admin-prohibited with kernels that do not support it will result in a plain DROP instead of REJECT diff --git a/extensions/libipt_ROUTE.man b/extensions/libipt_ROUTE.man new file mode 100644 index 00000000..dae1cb5f --- /dev/null +++ b/extensions/libipt_ROUTE.man @@ -0,0 +1,15 @@ +This is used to explicitly override the core network stack's routing decision. +.B mangle +table. +.TP +.BI "--oif " "ifname" +Route the packet through `ifname' network interface +.TP +.BI "--iif " "ifname" +Change the packet's incoming interface to `ifname' +.TP +.BI "--gw " "IP_address" +Route the packet via this gateway +.TP +.BI "--continue " +Behave like a non-terminating target and continue traversing the rules. Not valid in combination with `--iif' diff --git a/extensions/libipt_SNAT.man b/extensions/libipt_SNAT.man new file mode 100644 index 00000000..4cc03970 --- /dev/null +++ b/extensions/libipt_SNAT.man @@ -0,0 +1,26 @@ +This target is only valid in the +.B nat +table, in the +.B POSTROUTING +chain. It specifies that the source address of the packet should be +modified (and all future packets in this connection will also be +mangled), and rules should cease being examined. It takes one type +of option: +.TP +.BR "--to-source " "\fIipaddr\fP[-\fIipaddr\fP][:\fIport\fP-\fIport\fP]" +which can specify a single new source IP address, an inclusive range +of IP addresses, and optionally, a port range (which is only valid if +the rule also specifies +.B "-p tcp" +or +.BR "-p udp" ). +If no port range is specified, then source ports below 512 will be +mapped to other ports below 512: those between 512 and 1023 inclusive +will be mapped to ports below 1024, and other ports will be mapped to +1024 or above. Where possible, no port alteration will occur. +.RS +.PP +You can add several --to-source options. If you specify more +than one source address, either via an address range or multiple +--to-source options, a simple round-robin (one after another in +cycle) takes place between these adresses. diff --git a/extensions/libipt_TCPMSS.man b/extensions/libipt_TCPMSS.man new file mode 100644 index 00000000..da1bce2d --- /dev/null +++ b/extensions/libipt_TCPMSS.man @@ -0,0 +1,38 @@ +This target allows to alter the MSS value of TCP SYN packets, to control +the maximum size for that connection (usually limiting it to your +outgoing interface's MTU minus 40). Of course, it can only be used +in conjunction with +.BR "-p tcp" . +.br +This target is used to overcome criminally braindead ISPs or servers +which block ICMP Fragmentation Needed packets. The symptoms of this +problem are that everything works fine from your Linux +firewall/router, but machines behind it can never exchange large +packets: +.PD 0 +.RS 0.1i +.TP 0.3i +1) +Web browsers connect, then hang with no data received. +.TP +2) +Small mail works fine, but large emails hang. +.TP +3) +ssh works fine, but scp hangs after initial handshaking. +.RE +.PD +Workaround: activate this option and add a rule to your firewall +configuration like: +.nf + iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \\ + -j TCPMSS --clamp-mss-to-pmtu +.fi +.TP +.BI "--set-mss " "value" +Explicitly set MSS option to specified value. +.TP +.B "--clamp-mss-to-pmtu" +Automatically clamp MSS value to (path_MTU - 40). +.TP +These options are mutually exclusive. diff --git a/extensions/libipt_TOS.man b/extensions/libipt_TOS.man new file mode 100644 index 00000000..c31b068d --- /dev/null +++ b/extensions/libipt_TOS.man @@ -0,0 +1,11 @@ +This is used to set the 8-bit Type of Service field in the IP header. +It is only valid in the +.B mangle +table. +.TP +.BI "--set-tos " "tos" +You can use a numeric TOS values, or use +.nf + iptables -j TOS -h +.fi +to see the list of valid TOS names. diff --git a/extensions/libipt_TRACE.man b/extensions/libipt_TRACE.man new file mode 100644 index 00000000..549ab33b --- /dev/null +++ b/extensions/libipt_TRACE.man @@ -0,0 +1,3 @@ +This target has no options. It just turns on +.B packet tracing +for all packets that match this rule. diff --git a/extensions/libipt_TTL.man b/extensions/libipt_TTL.man new file mode 100644 index 00000000..97c46c43 --- /dev/null +++ b/extensions/libipt_TTL.man @@ -0,0 +1,19 @@ +This is used to modify the IPv4 TTL header field. The TTL field determines +how many hops (routers) a packet can traverse until it's time to live is +exceeded. +.TP +Setting or incrementing the TTL field can potentially be very dangerous, +so it should be avoided at any cost. +.TP +.B Don't ever set or increment the value on packets that leave your local network! +.B mangle +table. +.TP +.BI "--ttl-set " "value" +Set the TTL value to `value'. +.TP +.BI "--ttl-dec " "value" +Decrement the TTL value `value' times. +.TP +.BI "--ttl-inc " "value" +Increment the TTL value `value' times. diff --git a/extensions/libipt_ULOG.man b/extensions/libipt_ULOG.man new file mode 100644 index 00000000..51aa619f --- /dev/null +++ b/extensions/libipt_ULOG.man @@ -0,0 +1,27 @@ +This target provides userspace logging of matching packets. When this +target is set for a rule, the Linux kernel will multicast this packet +through a +.IR netlink +socket. One or more userspace processes may then subscribe to various +multicast groups and receive the packets. +Like LOG, this is a "non-terminating target", i.e. rule traversal +continues at the next rule. +.TP +.BI "--ulog-nlgroup " "nlgroup" +This specifies the netlink group (1-32) to which the packet is sent. +Default value is 1. +.TP +.BI "--ulog-prefix " "prefix" +Prefix log messages with the specified prefix; up to 32 characters +long, and useful for distinguishing messages in the logs. +.TP +.BI "--ulog-cprange " "size" +Number of bytes to be copied to userspace. A value of 0 always copies +the entire packet, regardless of its size. Default is 0. +.TP +.BI "--ulog-qthreshold " "size" +Number of packet to queue inside kernel. Setting this value to, e.g. 10 +accumulates ten packets inside the kernel and transmits them as one +netlink multipart message to userspace. Default is 1 (for backwards +compatibility). +.br diff --git a/extensions/libipt_addrtype.man b/extensions/libipt_addrtype.man new file mode 100644 index 00000000..2c3bbab0 --- /dev/null +++ b/extensions/libipt_addrtype.man @@ -0,0 +1,37 @@ +This module matches packets based on their +.B address type. +Address types are used within the kernel networking stack and categorize +addresses into various groups. The exact definition of that group depends on the specific layer three protocol. +.TP +The following address types are possible: +.TP +.BI "UNSPEC" +an unspecified address (i.e. 0.0.0.0) +.BI "UNICAST" +an unicast address +.BI "LOCAL" +a local address +.BI "BROADCAST" +a broadcast address +.BI "ANYCAST" +an anycast packet +.BI "MULTICAST" +a multicast address +.BI "BLACKHOLE" +a blackhole address +.BI "UNREACHABLE" +an unreachable address +.BI "PROHIBIT" +a prohibited address +.BI "THROW" +FIXME +.BI "NAT" +FIXME +.BI "XRESOLVE" +FIXME +.TP +.BI "--src-type " "type" +Matches if the source address is of given type +.TP +.BI "--dst-type " "type" +Matches if the destination address is of given type diff --git a/extensions/libipt_ah.man b/extensions/libipt_ah.man new file mode 100644 index 00000000..97de1e19 --- /dev/null +++ b/extensions/libipt_ah.man @@ -0,0 +1,3 @@ +This module matches the SPIs in AH header of IPSec packets. +.TP +.BR "--ahspi " "[!] \fIspi\fP[:\fIspi\fP]" diff --git a/extensions/libipt_condition.man b/extensions/libipt_condition.man new file mode 100644 index 00000000..0fc51ffe --- /dev/null +++ b/extensions/libipt_condition.man @@ -0,0 +1,4 @@ +This matches if a specific /proc filename is '0' or '1'. +.TP +.BI "--condition " "[!] filename" +Match on boolean value stored in /proc/net/ipt_condition/filename file diff --git a/extensions/libipt_conntrack.man b/extensions/libipt_conntrack.man new file mode 100644 index 00000000..b732b28e --- /dev/null +++ b/extensions/libipt_conntrack.man @@ -0,0 +1,49 @@ +This module, when combined with connection tracking, allows access to +more connection tracking information than the "state" match. +(this module is present only if iptables was compiled under a kernel +supporting this feature) +.TP +.BI "--ctstate " "state" +Where state is a comma separated list of the connection states to +match. Possible states are +.B INVALID +meaning that the packet is associated with no known connection, +.B ESTABLISHED +meaning that the packet is associated with a connection which has seen +packets in both directions, +.B NEW +meaning that the packet has started a new connection, or otherwise +associated with a connection which has not seen packets in both +directions, and +.B RELATED +meaning that the packet is starting a new connection, but is +associated with an existing connection, such as an FTP data transfer, +or an ICMP error. +.B SNAT +A virtual state, matching if the original source address differs from +the reply destination. +.B DNAT +A virtual state, matching if the original destination differs from the +reply source. +.TP +.BI "--ctproto " "proto" +Protocol to match (by number or name) +.TP +.BI "--ctorigsrc " "[!] \fIaddress\fP[/\fImask\fP]" +Match against original source address +.TP +.BI "--ctorigdst " "[!] \fIaddress\fP[/\fImask\fP]" +Match against original destination address +.TP +.BI "--ctreplsrc " "[!] \fIaddress\fP[/\fImask\fP]" +Match against reply source address +.TP +.BI "--ctrepldst " "[!] \fIaddress\fB[/\fImask\fP]" +Match against reply destination address +.TP +.BI "--ctstatus " "[\fINONE|EXPECTED|SEEN_REPLY|ASSURED\fP][,...]" +Match against internal conntrack states +.TP +.BI "--ctexpire " "\fItime\fP[\fI:time\fP]" +Match remaining lifetime in seconds against given value +or range of values (inclusive) diff --git a/extensions/libipt_dscp.man b/extensions/libipt_dscp.man new file mode 100644 index 00000000..4a842101 --- /dev/null +++ b/extensions/libipt_dscp.man @@ -0,0 +1,10 @@ +This module matches the 6 bit DSCP field within the TOS field in the +IP header. DSCP has superseded TOS within the IETF. +.TP +.BI "--dscp " "value" +Match against a numeric (decimal or hex) value [0-32]. +.TP +.BI "--dscp-class " "\fIDiffServ Class\fP" +Match the DiffServ class. This value may be any of the +BE, EF, AFxx or CSx classes. It will then be converted +into it's according numeric value. diff --git a/extensions/libipt_dstlimit.man b/extensions/libipt_dstlimit.man new file mode 100644 index 00000000..e4a4a5ab --- /dev/null +++ b/extensions/libipt_dstlimit.man @@ -0,0 +1,35 @@ +This module allows you to limit the packet per second (pps) rate on a per +destination IP or per destination port base. As opposed to the `limit' match, +every destination ip / destination port has it's own limit. +.TP +.BI "--dstlimit " "avg" +Maximum average match rate (packets per second unless followed by /sec /minute /hour /day postfixes). +.TP +.BI "--dstlimit-mode " "mode" +The limiting hashmode. Is the specified limit per +.B dstip, dstip-dstport +tuple, +.B srcip-dstip +tuple, or per +.B srcipdstip-dstport +tuple. +.TP +.BI "--dstlimit-name " "name" +Name for /proc/net/ipt_dstlimit/* file entry +.TP +.BI "[" "--dstlimit-burst " "burst" "]" +Number of packets to match in a burst. Default: 5 +.TP +.BI "[" "--dstlimit-htable-size " "size" "]" +Number of buckets in the hashtable +.TP +.BI "[" "--dstlimit-htable-max " "max" "]" +Maximum number of entries in the hashtable +.TP +.BI "[" "--dstlimit-htable-gcinterval " "interval" "]" +Interval between garbage collection runs of the hashtable (in miliseconds). +Default is 1000 (1 second). +.TP +.BI "[" "--dstlimit-htable-expire " "time" +After which time are idle entries expired from hashtable (in miliseconds)? +Default is 10000 (10 seconds). diff --git a/extensions/libipt_ecn.man b/extensions/libipt_ecn.man new file mode 100644 index 00000000..8ecfef59 --- /dev/null +++ b/extensions/libipt_ecn.man @@ -0,0 +1,11 @@ +This allows you to match the ECN bits of the IPv4 and TCP header. ECN is the Explicit Congestion Notification mechanism as specified in RFC3168 +.TP +.BI "--ecn-tcp-cwr" +This matches if the TCP ECN CWR (Congestion Window Received) bit is set. +.TP +.BI "--ecn-tcp-ece" +This matches if the TCP ECN ECE (ECN Echo) bit is set. +.TP +.BI "--ecn-ip-ect " "num" +This matches a particular IPv4 ECT (ECN-Capable Transport). You have to specify +a number between `0' and `3'. diff --git a/extensions/libipt_esp.man b/extensions/libipt_esp.man new file mode 100644 index 00000000..7b84368d --- /dev/null +++ b/extensions/libipt_esp.man @@ -0,0 +1,3 @@ +This module matches the SPIs in ESP header of IPSec packets. +.TP +.BR "--espspi " "[!] \fIspi\fP[:\fIspi\fP]" diff --git a/extensions/libipt_fuzzy.man b/extensions/libipt_fuzzy.man new file mode 100644 index 00000000..270c8d62 --- /dev/null +++ b/extensions/libipt_fuzzy.man @@ -0,0 +1,7 @@ +This module matches a rate limit based on a fuzzy logic controller [FLC] +.TP +.BI "--lower-limit "number" +Specifies the lower limit (in packets per second). +.TP +.BI "--upper-limit " "number" +Specifies the upper limit (in packets per second). diff --git a/extensions/libipt_helper.man b/extensions/libipt_helper.man new file mode 100644 index 00000000..c3221ad8 --- /dev/null +++ b/extensions/libipt_helper.man @@ -0,0 +1,11 @@ +This module matches packets related to a specific conntrack-helper. +.TP +.BI "--helper " "string" +Matches packets related to the specified conntrack-helper. +.RS +.PP +string can be "ftp" for packets related to a ftp-session on default port. +For other ports append -portnr to the value, ie. "ftp-2121". +.PP +Same rules apply for other conntrack-helpers. +.RE diff --git a/extensions/libipt_icmp.man b/extensions/libipt_icmp.man new file mode 100644 index 00000000..5b91514d --- /dev/null +++ b/extensions/libipt_icmp.man @@ -0,0 +1,9 @@ +This extension is loaded if `--protocol icmp' is specified. It +provides the following option: +.TP +.BR "--icmp-type " "[!] \fItypename\fP" +This allows specification of the ICMP type, which can be a numeric +ICMP type, or one of the ICMP type names shown by the command +.nf + iptables -p icmp -h +.fi diff --git a/extensions/libipt_iprange.man b/extensions/libipt_iprange.man new file mode 100644 index 00000000..57e1cff1 --- /dev/null +++ b/extensions/libipt_iprange.man @@ -0,0 +1,7 @@ +This matches on a given arbitrary range of IPv4 addresses +.TP +.BI "[!]" "--src-range " "ip-ip" +Match source IP in the specified range. +.TP +.BI "[!]" "--dst-range " "ip-ip" +Match destination IP in the specified range. diff --git a/extensions/libipt_length.man b/extensions/libipt_length.man new file mode 100644 index 00000000..72a6b5dc --- /dev/null +++ b/extensions/libipt_length.man @@ -0,0 +1,4 @@ +This module matches the length of a packet against a specific value +or range of values. +.TP +.BR "--length " "\fIlength\fP[:\fIlength\fP]" diff --git a/extensions/libipt_limit.man b/extensions/libipt_limit.man new file mode 100644 index 00000000..84b63d4e --- /dev/null +++ b/extensions/libipt_limit.man @@ -0,0 +1,15 @@ +This module matches at a limited rate using a token bucket filter. +A rule using this extension will match until this limit is reached +(unless the `!' flag is used). It can be used in combination with the +.B LOG +target to give limited logging, for example. +.TP +.BI "--limit " "rate" +Maximum average matching rate: specified as a number, with an optional +`/second', `/minute', `/hour', or `/day' suffix; the default is +3/hour. +.TP +.BI "--limit-burst " "number" +Maximum initial number of packets to match: this number gets +recharged by one every time the limit specified above is not reached, +up to this number; the default is 5. diff --git a/extensions/libipt_mac.man b/extensions/libipt_mac.man new file mode 100644 index 00000000..5321ca1c --- /dev/null +++ b/extensions/libipt_mac.man @@ -0,0 +1,10 @@ +.TP +.BR "--mac-source " "[!] \fIaddress\fP" +Match source MAC address. It must be of the form XX:XX:XX:XX:XX:XX. +Note that this only makes sense for packets coming from an Ethernet device +and entering the +.BR PREROUTING , +.B FORWARD +or +.B INPUT +chains. diff --git a/extensions/libipt_mark.man b/extensions/libipt_mark.man new file mode 100644 index 00000000..05f8e1ec --- /dev/null +++ b/extensions/libipt_mark.man @@ -0,0 +1,9 @@ +This module matches the netfilter mark field associated with a packet +(which can be set using the +.B MARK +target below). +.TP +.BR "--mark " "\fIvalue\fP[/\fImask\fP]" +Matches packets with the given unsigned mark value (if a mask is +specified, this is logically ANDed with the mask before the +comparison). diff --git a/extensions/libipt_mport.man b/extensions/libipt_mport.man new file mode 100644 index 00000000..cead84e7 --- /dev/null +++ b/extensions/libipt_mport.man @@ -0,0 +1,19 @@ +This module matches a set of source or destination ports. Up to 15 +ports can be specified. It can only be used in conjunction with +.B "-p tcp" +or +.BR "-p udp" . +.TP +.BR "--source-ports " "\fIport\fP[,\fIport\fP[,\fIport\fP...]]" +Match if the source port is one of the given ports. The flag +.B --sports +is a convenient alias for this option. +.TP +.BR "--destination-ports " "\fIport\fP[,\fIport\fP[,\fIport\fP...]]" +Match if the destination port is one of the given ports. The flag +.B --dports +is a convenient alias for this option. +.TP +.BR "--ports " "\fIport\fP[,\fIport\fP[,\fIport\fP...]]" +Match if the both the source and destination ports are equal to each +other and to one of the given ports. diff --git a/extensions/libipt_multiport.man b/extensions/libipt_multiport.man new file mode 100644 index 00000000..cead84e7 --- /dev/null +++ b/extensions/libipt_multiport.man @@ -0,0 +1,19 @@ +This module matches a set of source or destination ports. Up to 15 +ports can be specified. It can only be used in conjunction with +.B "-p tcp" +or +.BR "-p udp" . +.TP +.BR "--source-ports " "\fIport\fP[,\fIport\fP[,\fIport\fP...]]" +Match if the source port is one of the given ports. The flag +.B --sports +is a convenient alias for this option. +.TP +.BR "--destination-ports " "\fIport\fP[,\fIport\fP[,\fIport\fP...]]" +Match if the destination port is one of the given ports. The flag +.B --dports +is a convenient alias for this option. +.TP +.BR "--ports " "\fIport\fP[,\fIport\fP[,\fIport\fP...]]" +Match if the both the source and destination ports are equal to each +other and to one of the given ports. diff --git a/extensions/libipt_nth.man b/extensions/libipt_nth.man new file mode 100644 index 00000000..d215fd55 --- /dev/null +++ b/extensions/libipt_nth.man @@ -0,0 +1,14 @@ +This module matches every `n'th packet +.TP +.BI "--every " "value" +Match every `value' packet +.TP +.BI "[" "--counter " "num" "]" +Use internal counter number `num'. Default is `0'. +.TP +.BI "[" "--start " "num" "]" +Initialize the counter at the number `num' insetad of `0'. Most between `0' +and `value'-1. +.TP +.BI "[" "--packet " "num" "]" +Match on `num' packet. Most be between `0' and `value'-1. diff --git a/extensions/libipt_owner.man b/extensions/libipt_owner.man new file mode 100644 index 00000000..1394aca6 --- /dev/null +++ b/extensions/libipt_owner.man @@ -0,0 +1,26 @@ +This module attempts to match various characteristics of the packet +creator, for locally-generated packets. It is only valid in the +.B OUTPUT +chain, and even this some packets (such as ICMP ping responses) may +have no owner, and hence never match. +.TP +.BI "--uid-owner " "userid" +Matches if the packet was created by a process with the given +effective user id. +.TP +.BI "--gid-owner " "groupid" +Matches if the packet was created by a process with the given +effective group id. +.TP +.BI "--pid-owner " "processid" +Matches if the packet was created by a process with the given +process id. +.TP +.BI "--sid-owner " "sessionid" +Matches if the packet was created by a process in the given session +group. +.TP +.BI "--cmd-owner " "name" +Matches if the packet was created by a process with the given command name. +(this option is present only if iptables was compiled under a kernel +supporting this feature) diff --git a/extensions/libipt_physdev.man b/extensions/libipt_physdev.man new file mode 100644 index 00000000..846ec7c1 --- /dev/null +++ b/extensions/libipt_physdev.man @@ -0,0 +1,42 @@ +This module matches on the bridge port input and output devices enslaved +to a bridge device. This module is a part of the infrastructure that enables +a transparent bridging IP firewall and is only useful for kernel versions +above version 2.5.44. +.TP +.B --physdev-in name +Name of a bridge port via which a packet is received (only for +packets entering the +.BR INPUT , +.B FORWARD +and +.B PREROUTING +chains). If the interface name ends in a "+", then any +interface which begins with this name will match. If the packet didn't arrive +through a bridge device, this packet won't match this option, unless '!' is used. +.TP +.B --physdev-out name +Name of a bridge port via which a packet is going to be sent (for packets +entering the +.BR FORWARD , +.B OUTPUT +and +.B POSTROUTING +chains). If the interface name ends in a "+", then any +interface which begins with this name will match. Note that in the +.BR nat " and " mangle +.B OUTPUT +chains one cannot match on the bridge output port, however one can in the +.B "filter OUTPUT" +chain. If the packet won't leave by a bridge device or it is yet unknown what +the output device will be, then the packet won't match this option, unless +'!' is used. +.TP +.B --physdev-is-in +Matches if the packet has entered through a bridge interface. +.TP +.B --physdev-is-out +Matches if the packet will leave through a bridge interface. +.TP +.B --physdev-is-bridged +Matches if the packet is being bridged and therefore is not being routed. +This is only useful in the FORWARD and POSTROUTING chains. diff --git a/extensions/libipt_pkttype.man b/extensions/libipt_pkttype.man new file mode 100644 index 00000000..b52810b7 --- /dev/null +++ b/extensions/libipt_pkttype.man @@ -0,0 +1,3 @@ +This module matches the link-layer packet type. +.TP +.BI "--pkt-type " "[\fIunicast\fP|\fIbroadcast\fP|\fImulticast\fP]" diff --git a/extensions/libipt_random.man b/extensions/libipt_random.man new file mode 100644 index 00000000..f808a779 --- /dev/null +++ b/extensions/libipt_random.man @@ -0,0 +1,4 @@ +This module randomly matches a certain percentage of all packets. +.TP +.BI "--average " "percent" +Matches the given percentage. If omitted, a probability of 50% is set. diff --git a/extensions/libipt_realm.man b/extensions/libipt_realm.man new file mode 100644 index 00000000..55e67fcf --- /dev/null +++ b/extensions/libipt_realm.man @@ -0,0 +1,5 @@ +This matches the routing realm. Routing realms are used in complex routing +setups involving dynamic routing protocols like BGP. +.TP +.BI "--realm " "[!]" "value[/mask]" +Matches a given realm number (and optionally mask). diff --git a/extensions/libipt_state.man b/extensions/libipt_state.man new file mode 100644 index 00000000..71078680 --- /dev/null +++ b/extensions/libipt_state.man @@ -0,0 +1,21 @@ +This module, when combined with connection tracking, allows access to +the connection tracking state for this packet. +.TP +.BI "--state " "state" +Where state is a comma separated list of the connection states to +match. Possible states are +.B INVALID +meaning that the packet could not be identified for some reason which +includes running out of memory and ICMP errors which don't correspond to any +known connection, +.B ESTABLISHED +meaning that the packet is associated with a connection which has seen +packets in both directions, +.B NEW +meaning that the packet has started a new connection, or otherwise +associated with a connection which has not seen packets in both +directions, and +.B RELATED +meaning that the packet is starting a new connection, but is +associated with an existing connection, such as an FTP data transfer, +or an ICMP error. diff --git a/extensions/libipt_tcp.man b/extensions/libipt_tcp.man new file mode 100644 index 00000000..48a068fa --- /dev/null +++ b/extensions/libipt_tcp.man @@ -0,0 +1,49 @@ +These extensions are loaded if `--protocol tcp' is specified. It +provides the following options: +.TP +.BR "--source-port " "[!] \fIport\fP[:\fIport\fP]" +Source port or port range specification. This can either be a service +name or a port number. An inclusive range can also be specified, +using the format +.IR port : port . +If the first port is omitted, "0" is assumed; if the last is omitted, +"65535" is assumed. +If the second port greater then the first they will be swapped. +The flag +.B --sport +is a convenient alias for this option. +.TP +.BR "--destination-port " "[!] \fIport\fP[:\fIport\fP]" +Destination port or port range specification. The flag +.B --dport +is a convenient alias for this option. +.TP +.BR "--tcp-flags " "[!] \fImask\fP \fIcomp\fP" +Match when the TCP flags are as specified. The first argument is the +flags which we should examine, written as a comma-separated list, and +the second argument is a comma-separated list of flags which must be +set. Flags are: +.BR "SYN ACK FIN RST URG PSH ALL NONE" . +Hence the command +.nf + iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST SYN +.fi +will only match packets with the SYN flag set, and the ACK, FIN and +RST flags unset. +.TP +.B "[!] --syn" +Only match TCP packets with the SYN bit set and the ACK and RST bits +cleared. Such packets are used to request TCP connection initiation; +for example, blocking such packets coming in an interface will prevent +incoming TCP connections, but outgoing TCP connections will be +unaffected. +It is equivalent to \fB--tcp-flags SYN,RST,ACK SYN\fP. +If the "!" flag precedes the "--syn", the sense of the +option is inverted. +.TP +.BR "--tcp-option " "[!] \fInumber\fP" +Match if TCP option set. +.TP +.BR "--mss " "\fIvalue\fP[:\fIvalue\fP]" +Match TCP SYN or SYN/ACK packets with the specified MSS value (or range), +which control the maximum packet size for that connection. diff --git a/extensions/libipt_tcpmss.man b/extensions/libipt_tcpmss.man new file mode 100644 index 00000000..5115d6b9 --- /dev/null +++ b/extensions/libipt_tcpmss.man @@ -0,0 +1,4 @@ +This matches the TCP MSS (maximum segment size) field of the TCP header. You can only use this on TCP SYN or SYN/ACK packets, since the MSS is only negotiated during the TCP handshake at connection startup time. +.TP +.BI "[!] "--mss " "value[:value]" +Match a given TCP MSS value or range. diff --git a/extensions/libipt_time.man b/extensions/libipt_time.man new file mode 100644 index 00000000..0871ecfa --- /dev/null +++ b/extensions/libipt_time.man @@ -0,0 +1,10 @@ +This matches if the current time is within a given range. +.TP +.BI "--timestart " "value" +Match only if it is after `value' (Format: HH:MM). +.TP +.BI "--timestop " "value" +Match only if it is before `value' (Format: HH:MM). +.TP +.BI "--days " "listofdays" +Match only if today is one of the given days. (Format: Mon,Tue,Wed,Thu,Fri) diff --git a/extensions/libipt_tos.man b/extensions/libipt_tos.man new file mode 100644 index 00000000..c612b299 --- /dev/null +++ b/extensions/libipt_tos.man @@ -0,0 +1,9 @@ +This module matches the 8 bits of Type of Service field in the IP +header (ie. including the precedence bits). +.TP +.BI "--tos " "tos" +The argument is either a standard name, (use +.br + iptables -m tos -h +.br +to see the list), or a numeric value to match. diff --git a/extensions/libipt_ttl.man b/extensions/libipt_ttl.man new file mode 100644 index 00000000..f043c79a --- /dev/null +++ b/extensions/libipt_ttl.man @@ -0,0 +1,10 @@ +This module matches the time to live field in the IP header. +.TP +.BI "--ttl-eq " "ttl" +Matches the given TTL value. +.TP +.BI "--ttl-gt " "ttl" +Matches if TTL is greater than the given TTL value. +.TP +.BI "--ttl-lt " "ttl" +Matches if TTL is less than the given TTL value. diff --git a/extensions/libipt_udp.man b/extensions/libipt_udp.man new file mode 100644 index 00000000..04084797 --- /dev/null +++ b/extensions/libipt_udp.man @@ -0,0 +1,14 @@ +These extensions are loaded if `--protocol udp' is specified. It +provides the following options: +.TP +.BR "--source-port " "[!] \fIport\fP[:\fIport\fP]" +Source port or port range specification. +See the description of the +.B --source-port +option of the TCP extension for details. +.TP +.BR "--destination-port " "[!] \fIport\fP[:\fIport\fP]" +Destination port or port range specification. +See the description of the +.B --destination-port +option of the TCP extension for details. diff --git a/extensions/libipt_unclean.man b/extensions/libipt_unclean.man new file mode 100644 index 00000000..3fecd554 --- /dev/null +++ b/extensions/libipt_unclean.man @@ -0,0 +1,2 @@ +This module takes no options, but attempts to match packets which seem +malformed or unusual. This is regarded as experimental. -- cgit v1.2.3