Blame bootstrap_ver/extensions/libxt_tcp.man

Packit Service dd8e2b
These extensions can be used if `\-\-protocol tcp' is specified. It
Packit Service dd8e2b
provides the following options:
Packit Service dd8e2b
.TP
Packit Service dd8e2b
[\fB!\fP] \fB\-\-source\-port\fP,\fB\-\-sport\fP \fIport\fP[\fB:\fP\fIport\fP]
Packit Service dd8e2b
Source port or port range specification. This can either be a service
Packit Service dd8e2b
name or a port number. An inclusive range can also be specified,
Packit Service dd8e2b
using the format \fIfirst\fP\fB:\fP\fIlast\fP.
Packit Service dd8e2b
If the first port is omitted, "0" is assumed; if the last is omitted,
Packit Service dd8e2b
"65535" is assumed.
Packit Service dd8e2b
The flag
Packit Service dd8e2b
\fB\-\-sport\fP
Packit Service dd8e2b
is a convenient alias for this option.
Packit Service dd8e2b
.TP
Packit Service dd8e2b
[\fB!\fP] \fB\-\-destination\-port\fP,\fB\-\-dport\fP \fIport\fP[\fB:\fP\fIport\fP]
Packit Service dd8e2b
Destination port or port range specification.  The flag
Packit Service dd8e2b
\fB\-\-dport\fP
Packit Service dd8e2b
is a convenient alias for this option.
Packit Service dd8e2b
.TP
Packit Service dd8e2b
[\fB!\fP] \fB\-\-tcp\-flags\fP \fImask\fP \fIcomp\fP
Packit Service dd8e2b
Match when the TCP flags are as specified.  The first argument \fImask\fP is the
Packit Service dd8e2b
flags which we should examine, written as a comma-separated list, and
Packit Service dd8e2b
the second argument \fIcomp\fP is a comma-separated list of flags which must be
Packit Service dd8e2b
set.  Flags are:
Packit Service dd8e2b
.BR "SYN ACK FIN RST URG PSH ALL NONE" .
Packit Service dd8e2b
Hence the command
Packit Service dd8e2b
.nf
Packit Service dd8e2b
 iptables \-A FORWARD \-p tcp \-\-tcp\-flags SYN,ACK,FIN,RST SYN
Packit Service dd8e2b
.fi
Packit Service dd8e2b
will only match packets with the SYN flag set, and the ACK, FIN and
Packit Service dd8e2b
RST flags unset.
Packit Service dd8e2b
.TP
Packit Service dd8e2b
[\fB!\fP] \fB\-\-syn\fP
Packit Service dd8e2b
Only match TCP packets with the SYN bit set and the ACK,RST and FIN bits
Packit Service dd8e2b
cleared.  Such packets are used to request TCP connection initiation;
Packit Service dd8e2b
for example, blocking such packets coming in an interface will prevent
Packit Service dd8e2b
incoming TCP connections, but outgoing TCP connections will be
Packit Service dd8e2b
unaffected.
Packit Service dd8e2b
It is equivalent to \fB\-\-tcp\-flags SYN,RST,ACK,FIN SYN\fP.
Packit Service dd8e2b
If the "!" flag precedes the "\-\-syn", the sense of the
Packit Service dd8e2b
option is inverted.
Packit Service dd8e2b
.TP
Packit Service dd8e2b
[\fB!\fP] \fB\-\-tcp\-option\fP \fInumber\fP
Packit Service dd8e2b
Match if TCP option set.