diff options
authorFlorian Westphal <>2018-11-04 20:05:20 +0100
committerFlorian Westphal <>2018-11-05 17:29:48 +0100
commit2892dc4f5d9e8472f3b6f2f8915c9da63a730062 (patch)
parent685a06447ee472c77a961acc469186ed2064e34c (diff)
documentation: clarify iif vs. iifname
Signed-off-by: Florian Westphal <>
1 files changed, 24 insertions, 1 deletions
diff --git a/doc/primary-expression.txt b/doc/primary-expression.txt
index 761f50bc..5846898e 100644
--- a/doc/primary-expression.txt
+++ b/doc/primary-expression.txt
@@ -15,6 +15,29 @@ directly or as qualified meta expressions. Meta l4proto is useful to match a
particular transport protocol that is part of either an IPv4 or IPv6 packet. It
will also skip any IPv6 extension headers present in an IPv6 packet.
+meta iif, oif, iifname and oifname are used to match the interface a packet
+arrived on or is about to be sent out on.
+iif and oif are used to match on the interface index, whereas iifname and
+oifname are used to match on the interface name.
+This is not the same -- assuming the rule
+ filter input meta iif "foo"
+Then this rule can only be added if the interface "foo" exists.
+Also, the rule will continue to match even if the
+interface "foo" is renamed to "bar".
+This is because internally the interface index is used.
+In case of dynamically created interfaces, such as tun/tap or dialup
+interfaces (ppp for example), it might be better to use iifname or oifname
+In these cases, the name is used so the interface doesn't have to exist to
+add such a rule, it will stop matching if the interface gets renamed and it
+will match again in case interface gets deleted and later a new interface
+with the same name is created.
.Meta expression types
@@ -124,7 +147,7 @@ filter output meta oif eth0
# unqualified meta expression
filter output oif eth0
-# packed was subject to ipsec processing
+# packet was subject to ipsec processing
raw prerouting meta ipsec exists accept