|
Packit Service |
d1fe03 |
These extensions can be used if `\-\-protocol tcp' is specified. It
|
|
Packit Service |
d1fe03 |
provides the following options:
|
|
Packit Service |
d1fe03 |
.TP
|
|
Packit Service |
d1fe03 |
[\fB!\fP] \fB\-\-source\-port\fP,\fB\-\-sport\fP \fIport\fP[\fB:\fP\fIport\fP]
|
|
Packit Service |
d1fe03 |
Source port or port range specification. This can either be a service
|
|
Packit Service |
d1fe03 |
name or a port number. An inclusive range can also be specified,
|
|
Packit Service |
d1fe03 |
using the format \fIfirst\fP\fB:\fP\fIlast\fP.
|
|
Packit Service |
d1fe03 |
If the first port is omitted, "0" is assumed; if the last is omitted,
|
|
Packit Service |
d1fe03 |
"65535" is assumed.
|
|
Packit Service |
d1fe03 |
The flag
|
|
Packit Service |
d1fe03 |
\fB\-\-sport\fP
|
|
Packit Service |
d1fe03 |
is a convenient alias for this option.
|
|
Packit Service |
d1fe03 |
.TP
|
|
Packit Service |
d1fe03 |
[\fB!\fP] \fB\-\-destination\-port\fP,\fB\-\-dport\fP \fIport\fP[\fB:\fP\fIport\fP]
|
|
Packit Service |
d1fe03 |
Destination port or port range specification. The flag
|
|
Packit Service |
d1fe03 |
\fB\-\-dport\fP
|
|
Packit Service |
d1fe03 |
is a convenient alias for this option.
|
|
Packit Service |
d1fe03 |
.TP
|
|
Packit Service |
d1fe03 |
[\fB!\fP] \fB\-\-tcp\-flags\fP \fImask\fP \fIcomp\fP
|
|
Packit Service |
d1fe03 |
Match when the TCP flags are as specified. The first argument \fImask\fP is the
|
|
Packit Service |
d1fe03 |
flags which we should examine, written as a comma-separated list, and
|
|
Packit Service |
d1fe03 |
the second argument \fIcomp\fP is a comma-separated list of flags which must be
|
|
Packit Service |
d1fe03 |
set. Flags are:
|
|
Packit Service |
d1fe03 |
.BR "SYN ACK FIN RST URG PSH ALL NONE" .
|
|
Packit Service |
d1fe03 |
Hence the command
|
|
Packit Service |
d1fe03 |
.nf
|
|
Packit Service |
d1fe03 |
iptables \-A FORWARD \-p tcp \-\-tcp\-flags SYN,ACK,FIN,RST SYN
|
|
Packit Service |
d1fe03 |
.fi
|
|
Packit Service |
d1fe03 |
will only match packets with the SYN flag set, and the ACK, FIN and
|
|
Packit Service |
d1fe03 |
RST flags unset.
|
|
Packit Service |
d1fe03 |
.TP
|
|
Packit Service |
d1fe03 |
[\fB!\fP] \fB\-\-syn\fP
|
|
Packit Service |
d1fe03 |
Only match TCP packets with the SYN bit set and the ACK,RST and FIN bits
|
|
Packit Service |
d1fe03 |
cleared. Such packets are used to request TCP connection initiation;
|
|
Packit Service |
d1fe03 |
for example, blocking such packets coming in an interface will prevent
|
|
Packit Service |
d1fe03 |
incoming TCP connections, but outgoing TCP connections will be
|
|
Packit Service |
d1fe03 |
unaffected.
|
|
Packit Service |
d1fe03 |
It is equivalent to \fB\-\-tcp\-flags SYN,RST,ACK,FIN SYN\fP.
|
|
Packit Service |
d1fe03 |
If the "!" flag precedes the "\-\-syn", the sense of the
|
|
Packit Service |
d1fe03 |
option is inverted.
|
|
Packit Service |
d1fe03 |
.TP
|
|
Packit Service |
d1fe03 |
[\fB!\fP] \fB\-\-tcp\-option\fP \fInumber\fP
|
|
Packit Service |
d1fe03 |
Match if TCP option set.
|