IPTABLES(8) iptables 1.8.11 IPTABLES(8) (NAME) iptables - NAT IPv4 (SYNOPSIS) iptables [-t table] {-A|-C|-D|-V} chain rule-specification ip6tables [-t table] {-A|-C|-D|-V} chain rule-specification iptables [-t table] -I chain [rulenum] rule-specification iptables [-t table] -R chain rulenum rule-specification iptables [-t table] -D chain rulenum iptables [-t table] -S [chain [rulenum]] iptables [-t table] {-F|-L|-Z} [chain [rulenum]] [options...] iptables [-t table] -N chain iptables [-t table] -X [chain] iptables [-t table] -P chain policy iptables [-t table] -E old-chain-name new-chain-name rule-specification := [matches...] [target] match := -m matchname [per-match-options] target := -j targetname [per-target-options] (DESCRIPTION) iptables ip6tables IPv4 IPv6 . . (built-in) . . . <<>> (target) . (TARGETS) . iptables-extensions(8) ACCEPT DROP RETURN . ACCEPT . DROP . RETURN () . RETURN (policy) . (TABLES) ( ). -t, --able table . . : filter: ( -t ). : INPUT ( ) FORWARD ( ) OUTPUT ( ). nat: . : PREROUTING ( ) INPUT ( ) OUTPUT ( ) POSTROUTING ( ). NAT IPv6 3.7 . mangle: . 2.4.17 : PREROUTING ( ) OUTPUT ( ). 2.4.18 : INPUT ( ) FORWARD ( ) POSTROUTING ( ). raw: NOTRACK . netfilter ip_conntrack IP . : PREROUTING ( ) OUTPUT ( ). security: (MAC) SECMARK CONNSECMARK . SELinux . security filter (DAC) filter MAC . : INPUT ( ) OUTPUT ( ) FORWARD ( ). (OPTIONS) iptables ip6tables . (COMMANDS) . . iptables . -A, --ppend chain rule-specification . . -C, --heck chain rule-specification . -D iptables . -D, --elete chain rule-specification -D, --elete chain rulenum . : ( ) . -I, --insert chain [rulenum] rule-specification . . . -R, --eplace chain rulenum rule-specification . . . -L, --n] . . iptables (filter ) NAT : iptables -t nat -n -L -n DNS . -Z ( ) () . . : iptables -L -v iptables-save(8). -S, --n] . iptables-save . iptables (filter ). -F, --ush [chain] ( ). . -Z, --ro [chain [rulenum]] . -L -- () ( ). -N, --0w-chain chain . . -X, --elete-chain [chain] . . . . . iptables-nft . -P, --olicy chain target (policy) ( ) . ACCEPT DROP . -E, --ename-chain old-chain new-chain . . -h . ( ) . (PARAMETERS) ( ). -4, --ipv4 iptables iptables-restore . -4 ip6tables-restore . . IPv4 IPv6 iptables-restore ip6tables-restore . -6, --ipv6 -6 iptables-restore . . IPv4 IPv6 iptables-restore ip6tables-restore . ip6tables ip6tables-restore . [!] -p, --rotocol protocol . tcp udp udplite icmp icmpv6 esp ah sctp mh all . /etc/protocols . "!" . all . all . ip6tables IPv6 esp . esp ipv6-nonext 2.6.11 . all 0 . HBH -p 0 -m hbh . [!] -s, --urce address[/mask][,...] . address IP ( /mask) IP . . DNS . mask ipv4 ( iptables) . iptables 24 255.255.255.0 . "!" . --c . ( -A) ( -D). [!] -d, --estination address[/mask][,...] . -s () . --st . -m, --tch match . . (short-circuit) (false) . -j, --jump target . ( ) ( (MATCH AND TARGET EXTENSIONS) ). ( -g ) . -g, --to chain . --jump RETURN --jump . [!] -i, --in-interface name ( INPUT FORWARD PREROUTING ). "!" . "+" . . [!] -o, -- ( FORWARD OUTPUT POSTROUTING ). "!" . "+" . . [!] -f, --agment IPv4 (fragmented) . ( ICMP) . "!" "-f" . IPv4 ip6tables . -c, --t-counters packets bytes ( INSERT APPEND REPLACE). (OTHER OPTIONS) : -v, -- . ( ) TOS . 'K' 'M' 'G' ( -x ). . -v : iptables-legacy libiptc iptables-nft netlink ( ) . iptables-nft netlink . -V, -- API . -w, --288 xtables. . . ( seconds) . -n, --0meric . IP . ( ) . -x, --\xact . K ( ) M ( K) G ( M). -L . -- . --dprobe=command command ( ) . (LOCK FILE) iptables /run/xtables.lock . XTABLES_LOCKFILE . (MATCH AND TARGET EXTENSIONS) iptables . iptables-extensions(8) . (DIAGNOSTICS) . 0 . 2 . 3 . 4 . 1 . (BUGS) ;-) https://bugzilla.netfilter.org . iptables setuid-to-root 111 . iptables ( ) . IPCHAINS (COMPATIBILITY WITH IPCHAINS) iptables ipchains Rusty Russell . INPUT OUTPUT . ( loopback INPUT OUTPUT ) (forwarded) . -i -o FORWARD . NAT iptables 'filter' . IP (masquerading) . : -j MASQ -M -S -M -L iptables . (SEE ALSO) iptables-apply(8), iptables-save(8), iptables-restore(8), iptables-extensions(8), packet-filtering-HOWTO iptables NAT-HOWTO NAT netfilter-extensions-HOWTO netfilter-hacking-HOWTO . : https://www.netfilter.org. (AUTHORS) iptables Rusty Russell Michael Neuling . Marc Boucher iptables Rusty ipnatctl mangle (owner match) mark . James Morris TOS tos . Jozsef Kadlecsik REJECT . Harald Welte ULOG NFQUEUE libiptc TTL DSCP ECN . Netfilter : Jozsef Kadlecsik Pablo Neira Ayuso Eric Leblond Florian Westphal Arturo Borrero Gonzalez. : Marc Boucher Martin Josefsson Yasuyuki Kozakai James Morris Harald Welte Rusty Russell. Herve Eychenne . (VERSION) iptables/ip6tables 1.8.11 . iptables 1.8.11 IPTABLES(8)