NAME
       iptables - IP packet filter administration

SYNOPSIS
       iptables -[ADC] chain rule-specification [options]
       iptables -I chain [rulenum] rule-specification [options]
       iptables -R chain rulenum rule-specification [options]
       iptables -D chain rulenum [options]
       iptables -[LFZ] [chain] [options]
       iptables -N chain
       iptables -X [chain]
       iptables -P chain target [options]
       iptables -E old-chain-name new-chain-name

DESCRIPTION
       Iptables  is  used  to  set  up, maintain, and inspect the tables of IP
       packet filter rules in the Linux kernel.  Several different tables  may
       be  defined.   Each  table contains a number of built-in chains and may
       also contain user-defined chains.

       Each chain is a list of rules which can match a set of  packets.   Each
       rule specifies what to do with a packet that matches.  This is called a
       (target), which may be a jump to a user-defined chain in the same table.

TARGETS
       A  firewall rule specifies criteria for a packet, and a target.  If the
       packet does not match, the next rule in the chain is the  examined;  if
       it does match, then the next rule is specified by the value of the target,
       which can be the name of a user-defined chain or one of  the  special
       values ACCEPT, DROP, QUEUE, or RETURN.

       ACCEPT  means to let the packet through.  DROP means to drop the packet
       on the floor.  QUEUE means to pass the packet  to  userspace  (if  supported
       by  the  kernel). RETURN means stop traversing this chain and
       resume at the next rule in the previous (calling) chain.  If the end of
       a  builtin  chain is reached or a rule in a builtin chain with target
       RETURN is matched, the target specified by the chain policy  determines
       the fate of the packet.

TABLES
       There are current three independent tables (which tables are present at
       any time depends on the kernel configuration options and which  modules
       are present).

       -t, --table table
              This  option  specifies the packet matching table which the com-
              mand should operate on.  If the kernel is configured with  auto-
              matic module loading, an attempt will be made to load the appro-
              priate module for that table if it is not already there.

              The tables are as follows:

       filter This is the default table.   It  contains  the  built-in  chains
              INPUT  (for  packets  coming  into the box itself), FORWARD (for
              packets being routed through the box), and OUTPUT (for  locally-
              generated packets).

       nat    This table is consulted when a packet that creates a new connec-
              tion is encountered.  It consists of three built-ins: PREROUTING
              (for  altering  packets  as  soon  as they come in), OUTPUT (for
              altering  locally-generated   packets   before   routing),   and
              POSTROUTING  (for altering packets as they are about to go out).

       mangle This table is used for  specialized  packet  alteration.   Until
              kernel 2.4.17 it had two built-in chains: PREROUTING (for alter-
              ing incoming packets before routing) and  OUTPUT  (for  altering
              locally-generated packets before routing).  Since kernel 2.4.18,
              three other built-in chains are  also  supported  :  INPUT  (for
              packets coming into the box itself), FORWARD (for altering pack-
              ets being routed through the box), and POSTROUTING (for altering
              packets as they are about to go out).

OPTIONS
       The options that are recognized by iptables can be divided into several
       different groups.

   COMMANDS
       These options specify the specific action to perform.  Only one of them
       can  be specified on the command line unless otherwise specified below.
       For all the long versions of the command and option names, you need  to
       use  only  enough  letters to ensure that iptables can differentiate it
       from all other options.

       -A, --append chain rule-specification
              Append one or more rules to the end of the selected chain.  When
              the  source  and/or  destination  names resolve to more than one
              address, a rule will be added for each possible address combina-
              tion.

       -D, --delete chain rule-specification
       -D, --delete chain rulenum
              Delete one or more rules from the selected chain.  There are two
              versions of this command: the rule can be specified as a  number
              in  the  chain  (starting  at 1 for the first rule) or a rule to
              match.

       -I, --insert chain [rulenum] rule-specification
              Insert one or more rules in the selected chain as the given rule
              number.   So,  if  the  rule  number is 1, the rule or rules are
              inserted at the head of the chain.  This is also the default  if
              no rule number is specified.

       -R, --replace chain rulenum rule-specification
              Replace a rule in the selected chain.  If the source and/or des-
              tination names resolve to multiple addresses, the  command  will
              fail.  Rules are numbered starting at 1.

	             -L, --list [chain]
              List  all rules in the selected chain.  If no chain is selected,
              all chains are listed.  As  every  other  iptables  command,  it
              applies  to  the specified table (filter is the default), so NAT
              rules get listed by
               iptables -t nat -n -L
              Please note that it is often used with the -n option,  in  order
              to  avoid  long reverse DNS lookups.  It is legal to specify the
              -Z (zero) option as well, in which case  the  chain(s)  will  be
              atomically  listed  and zeroed.  The exact output is affected by
              the other arguments given.

       -F, --flush [chain]
              Flush the selected chain (all the chains in the table if none is
              given).   This  is  equivalent  to deleting all the rules one by
              one.

       -Z, --zero [chain]
              Zero the packet and byte counters in all chains.  It is legal to
              specify  the  -L, --list (list) option as well, to see the coun-
              ters immediately before they are cleared. (See above.)

       -N, --new-chain chain
              Create a new user-defined chain by the given name.   There  must
              be no target of that name already.

       -X, --delete-chain [chain]
              Delete the optional user-defined chain specified.  There must be
              no references to the chain.  If there are, you  must  delete  or
              replace the referring rules before the chain can be deleted.  If
              no argument is given, it  will  attempt  to  delete  every  non-
              builtin chain in the table.

	             -P, --policy chain target
              Set  the policy for the chain to the given target.  See the sec-
              tion TARGETS for the legal targets.   Only  built-in  (non-user-
              defined)  chains  can  have  policies,  and neither built-in nor
              user-defined chains can be policy targets.

       -E, --rename-chain old-chain new-chain
              Rename the user specified chain to the user supplied name.  This
              is cosmetic, and has no effect on the structure of the table.

       -h     Help.   Give a (currently very brief) description of the command
              syntax.

   PARAMETERS
       The following parameters make up a rule specification (as used  in  the
       add, delete, insert, replace and append commands).

       -p, --protocol [!] protocol
              The  protocol of the rule or of the packet to check.  The speci-
              fied protocol can be one of tcp, udp, icmp, or all, or it can be
              a  numeric  value, representing one of these protocols or a dif-
              ferent  one.   A  protocol  name  from  /etc/protocols  is  also
              allowed.   A  "!" argument before the protocol inverts the test.
              The number zero is equivalent to all.  Protocol all  will  match
              with  all  protocols and is taken as default when this option is
              omitted.

       -s, --source [!] address[/mask]
              Source specification.  Address can be either a network  name,  a
              hostname  (please  note  that specifying any name to be resolved
              with a remote query such as DNS is a really bad idea), a network
              IP address (with /mask), or a plain IP address.  The mask can be
              either a network mask or a plain number, specifying  the  number
              of 1-s at the left side of the network mask.  Thus, a mask of 24
              is equivalent to  255.255.255.0.   A  "!"  argument  before  the
              address specification inverts the sense of the address. The flag
              --src is an alias for this option.

       -d, --destination [!] address[/mask]
              Destination  specification.   See  the  description  of  the  -s
              (source)  flag  for  a  detailed description of the syntax.  The
              flag --dst is an alias for this option.

       -j, --jump target
              This specifies the target of the rule; i.e., what to do  if  the
              packet  matches  it.   The  target  can  be a user-defined chain
              (other than the one this rule is in), one of the special builtin
              targets  which  decide the fate of the packet immediately, or an
              extension (see EXTENSIONS below).  If this option is omitted  in
              a  rule,  then  matching  the  rule  will  have no effect on the
              packet-s fate, but the counters on the rule will be incremented.

       -i, --in-interface [!] name
              Name  of an interface via which a packet is going to be received
