NAME iptables ? IP packet filter administration SYNOPSIS iptables ?[ADC] chain rule?specification [options] iptables ?I chain [rulenum] rule?specification [options] iptables ?R chain rulenum rule?specification [options] iptables ?D chain rulenum [options] iptables ?[LFZ] [chain] [options] iptables ?N chain iptables ?X [chain] iptables ?P chain target [options] iptables ?E old?chain?name new?chain?name DESCRIPTION Iptables is used to set up, maintain, and inspect the tables of IP packet filter rules in the Linux kernel. Several different tables may be defined. Each table contains a number of built?in chains and may also contain user?defined chains. Each chain is a list of rules which can match a set of packets. Each rule specifies what to do with a packet that matches. This is called a ?target?, which may be a jump to a user?defined chain in the same ta? ble. TARGETS A firewall rule specifies criteria for a packet, and a target. If the packet does not match, the next rule in the chain is the examined; if it does match, then the next rule is specified by the value of the tar? get, which can be the name of a user?defined chain or one of the spe? cial values ACCEPT, DROP, QUEUE, or RETURN. ACCEPT means to let the packet through. DROP means to drop the packet on the floor. QUEUE means to pass the packet to userspace (if sup? ported by the kernel). RETURN means stop traversing this chain and resume at the next rule in the previous (calling) chain. If the end of a built?in chain is reached or a rule in a built?in chain with target RETURN is matched, the target specified by the chain policy determines the fate of the packet. TABLES There are current three independent tables (which tables are present at any time depends on the kernel configuration options and which modules are present). ?t, ??table table This option specifies the packet matching table which the com? mand should operate on. If the kernel is configured with auto? matic module loading, an attempt will be made to load the appro? priate module for that table if it is not already there. The tables are as follows: filter This is the default table. It contains the built?in chains INPUT (for packets coming into the box itself), FORWARD (for packets being routed through the box), and OUTPUT (for locally? generated packets). nat This table is consulted when a packet that creates a new connec? tion is encountered. It consists of three built?ins: PREROUTING (for altering packets as soon as they come in), OUTPUT (for altering locally?generated packets before routing), and POSTROUTING (for altering packets as they are about to go out). mangle This table is used for specialized packet alteration. Until kernel 2.4.17 it had two built?in chains: PREROUTING (for alter? ing incoming packets before routing) and OUTPUT (for altering locally?generated packets before routing). Since kernel 2.4.18, three other built?in chains are also supported : INPUT (for packets coming into the box itself), FORWARD (for altering pack? ets being routed through the box), and POSTROUTING (for altering packets as they are about to go out). OPTIONS The options that are recognized by iptables can be divided into several different groups. COMMANDS These options specify the specific action to perform. Only one of them can be specified on the command line unless otherwise specified below. For all the long versions of the command and option names, you need to use only enough letters to ensure that iptables can differentiate it from all other options. ?A, ??append chain rule?specification Append one or more rules to the end of the selected chain. When the source and/or destination names resolve to more than one address, a rule will be added for each possible address combina? tion. ?D, ??delete chain rule?specification ?D, ??delete chain rulenum Delete one or more rules from the selected chain. There are two versions of this command: the rule can be specified as a number in the chain (starting at 1 for the first rule) or a rule to match. ?I, ??insert chain [rulenum] rule?specification Insert one or more rules in the selected chain as the given rule number. So, if the rule number is 1, the rule or rules are inserted at the head of the chain. This is also the default if no rule number is specified. ?R, ??replace chain rulenum rule?specification Replace a rule in the selected chain. If the source and/or des? tination names resolve to multiple addresses, the command will fail. Rules are numbered starting at 1. ?L, ??list [chain] List all rules in the selected chain. If no chain is selected, all chains are listed. As every other iptables command, it applies to the specified table (filter is the default), so NAT rules get listed by iptables ?t nat ?n ?L Please note that it is often used with the ?n option, in order to avoid long reverse DNS lookups. It is legal to specify the ?Z (zero) option as well, in which case the chain(s) will be atomically listed and zeroed. The exact output is affected by the other arguments given. ?F, ??flush [chain] Flush the selected chain (all the chains in the table if none is given). This is equivalent to deleting all the rules one by one. ?Z, ??zero [chain] Zero the packet and byte counters in all chains. It is legal to specify the ?L, ??list (list) option as well, to see the coun? ters immediately before they are cleared. (See above.) ?N, ??new?chain chain Create a new user?defined chain by the given name. There must be no target of that name already. ?X, ??delete?chain [chain] Delete the optional user?defined chain specified. There must be no references to the chain. If there are, you must delete or replace the referring rules before the chain can be deleted. If no argument is given, it will attempt to delete every non? builtin chain in the table. ?P, ??policy chain target Set the policy for the chain to the given target. See the sec? tion TARGETS for the legal targets. Only built?in (non?user? defined) chains can have policies, and neither built?in nor user?defined chains can be policy targets. ?E, ??rename?chain old?chain new?chain Rename the user specified chain to the user supplied name. This is cosmetic, and has no effect on the structure of the table. ?h Help. Give a (currently very brief) description of the command syntax. PARAMETERS The following parameters make up a rule specification (as used in the add, delete, insert, replace and append commands). ?p, ??protocol [!] protocol The protocol of the rule or of the packet to check. The speci? fied protocol can be one of tcp, udp, icmp, or all, or it can be a numeric value, representing one of these protocols or a dif? ferent one. A protocol name from /etc/protocols is also allowed. A "!" argument before the protocol inverts the test. The number zero is equivalent to all. Protocol all will match with all protocols and is taken as default when this option is omitted. ?s, ??source [!] address[/mask] Source specification. Address can be either a network name, a hostname (please note that specifying any name to be resolved with a remote query such as DNS is a really bad idea), a network IP address (with /mask), or a plain IP address. The mask can be either a network mask or a plain number, specifying the number of 1?s at the left side of the network mask. Thus, a mask of 24 is equivalent to 255.255.255.0. A "!" argument before the address specification inverts the sense of the address. The flag ??src is an alias for this option. ?d, ??destination [!] address[/mask] Destination specification. See the description of the ?s (source) flag for a detailed description of the syntax. The flag ??dst is an alias for this option. ?j, ??jump target This specifies the target of the rule; i.e., what to do if the packet matches it. The target can be a user?defined chain (other than the one this rule is in), one of the special builtin targets which decide the fate of the packet immediately, or an extension (see EXTENSIONS below). If this option is omitted in a rule, then matching the rule will have no effect on the packet?s fate, but the counters on the rule will be incremented. ?i, ??in?interface [!] name Name of an interface via which a packet is going to be received