Jan Engelhardt | 8d67190 | 2009-01-08 18:03:45 +0100 | [diff] [blame] | 1 | .TH IPTABLES 8 "" "@PACKAGE_AND_VERSION@" "@PACKAGE_AND_VERSION@" |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 2 | .\" |
| 3 | .\" Man page written by Herve Eychenne <rv@wallfire.org> (May 1999) |
| 4 | .\" It is based on ipchains page. |
| 5 | .\" TODO: add a word for protocol helpers (FTP, IRC, SNMP-ALG) |
| 6 | .\" |
| 7 | .\" ipchains page by Paul ``Rusty'' Russell March 1997 |
| 8 | .\" Based on the original ipfwadm man page by Jos Vos <jos@xos.nl> |
| 9 | .\" |
| 10 | .\" This program is free software; you can redistribute it and/or modify |
| 11 | .\" it under the terms of the GNU General Public License as published by |
| 12 | .\" the Free Software Foundation; either version 2 of the License, or |
| 13 | .\" (at your option) any later version. |
| 14 | .\" |
| 15 | .\" This program is distributed in the hope that it will be useful, |
| 16 | .\" but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 17 | .\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| 18 | .\" GNU General Public License for more details. |
| 19 | .\" |
| 20 | .\" You should have received a copy of the GNU General Public License |
| 21 | .\" along with this program; if not, write to the Free Software |
| 22 | .\" Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. |
| 23 | .\" |
| 24 | .\" |
| 25 | .SH NAME |
Jan Engelhardt | 352ccfb | 2009-08-20 17:15:22 +0200 | [diff] [blame] | 26 | iptables \(em administration tool for IPv4 packet filtering and NAT |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 27 | .SH SYNOPSIS |
Stefan Tomanek | d59b9db | 2011-03-08 22:42:51 +0100 | [diff] [blame] | 28 | \fBiptables\fP [\fB\-t\fP \fItable\fP] {\fB\-A\fP|\fB\-C\fP|\fB\-D\fP} |
| 29 | \fIchain\fP \fIrule-specification\fP |
Jan Engelhardt | 8a679dc | 2008-10-29 09:48:23 +0100 | [diff] [blame] | 30 | .PP |
Jan Engelhardt | 1791a45 | 2009-02-20 16:39:54 +0100 | [diff] [blame] | 31 | \fBiptables\fP [\fB\-t\fP \fItable\fP] \fB\-I\fP \fIchain\fP [\fIrulenum\fP] \fIrule-specification\fP |
Jan Engelhardt | 8a679dc | 2008-10-29 09:48:23 +0100 | [diff] [blame] | 32 | .PP |
Jan Engelhardt | 1791a45 | 2009-02-20 16:39:54 +0100 | [diff] [blame] | 33 | \fBiptables\fP [\fB\-t\fP \fItable\fP] \fB\-R\fP \fIchain rulenum rule-specification\fP |
Jan Engelhardt | 8a679dc | 2008-10-29 09:48:23 +0100 | [diff] [blame] | 34 | .PP |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 35 | \fBiptables\fP [\fB\-t\fP \fItable\fP] \fB\-D\fP \fIchain rulenum\fP |
Jan Engelhardt | 8a679dc | 2008-10-29 09:48:23 +0100 | [diff] [blame] | 36 | .PP |
Jan Engelhardt | 1791a45 | 2009-02-20 16:39:54 +0100 | [diff] [blame] | 37 | \fBiptables\fP [\fB\-t\fP \fItable\fP] \fB\-S\fP [\fIchain\fP [\fIrulenum\fP]] |
Jan Engelhardt | 8a679dc | 2008-10-29 09:48:23 +0100 | [diff] [blame] | 38 | .PP |
Jan Engelhardt | fe086ba | 2009-08-19 22:36:03 +0200 | [diff] [blame] | 39 | \fBiptables\fP [\fB\-t\fP \fItable\fP] {\fB\-F\fP|\fB\-L\fP|\fB\-Z\fP} [\fIchain\fP [\fIrulenum\fP]] [\fIoptions...\fP] |
Jan Engelhardt | 8a679dc | 2008-10-29 09:48:23 +0100 | [diff] [blame] | 40 | .PP |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 41 | \fBiptables\fP [\fB\-t\fP \fItable\fP] \fB\-N\fP \fIchain\fP |
Jan Engelhardt | 8a679dc | 2008-10-29 09:48:23 +0100 | [diff] [blame] | 42 | .PP |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 43 | \fBiptables\fP [\fB\-t\fP \fItable\fP] \fB\-X\fP [\fIchain\fP] |
Jan Engelhardt | 8a679dc | 2008-10-29 09:48:23 +0100 | [diff] [blame] | 44 | .PP |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 45 | \fBiptables\fP [\fB\-t\fP \fItable\fP] \fB\-P\fP \fIchain target\fP |
Jan Engelhardt | 8a679dc | 2008-10-29 09:48:23 +0100 | [diff] [blame] | 46 | .PP |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 47 | \fBiptables\fP [\fB\-t\fP \fItable\fP] \fB\-E\fP \fIold-chain-name new-chain-name\fP |
Jan Engelhardt | 6362bc8 | 2008-10-29 09:48:59 +0100 | [diff] [blame] | 48 | .PP |
| 49 | rule-specification = [\fImatches...\fP] [\fItarget\fP] |
| 50 | .PP |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 51 | match = \fB\-m\fP \fImatchname\fP [\fIper-match-options\fP] |
Jan Engelhardt | 6362bc8 | 2008-10-29 09:48:59 +0100 | [diff] [blame] | 52 | .PP |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 53 | target = \fB\-j\fP \fItargetname\fP [\fIper\-target\-options\fP] |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 54 | .SH DESCRIPTION |
Jan Engelhardt | 55dffef | 2008-07-03 20:27:50 +0200 | [diff] [blame] | 55 | \fBIptables\fP is used to set up, maintain, and inspect the |
| 56 | tables of IPv4 packet |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 57 | filter rules in the Linux kernel. Several different tables |
| 58 | may be defined. Each table contains a number of built-in |
| 59 | chains and may also contain user-defined chains. |
Jan Engelhardt | 0c2b5a4 | 2009-01-08 18:04:40 +0100 | [diff] [blame] | 60 | .PP |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 61 | Each chain is a list of rules which can match a set of packets. Each |
| 62 | rule specifies what to do with a packet that matches. This is called |
| 63 | a `target', which may be a jump to a user-defined chain in the same |
| 64 | table. |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 65 | .SH TARGETS |
Jan Engelhardt | 6cf172e | 2008-03-10 17:48:59 +0100 | [diff] [blame] | 66 | A firewall rule specifies criteria for a packet and a target. If the |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 67 | packet does not match, the next rule in the chain is the examined; if |
| 68 | it does match, then the next rule is specified by the value of the |
| 69 | target, which can be the name of a user-defined chain or one of the |
Jan Engelhardt | 55dffef | 2008-07-03 20:27:50 +0200 | [diff] [blame] | 70 | special values \fBACCEPT\fP, \fBDROP\fP, \fBQUEUE\fP or \fBRETURN\fP. |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 71 | .PP |
Jan Engelhardt | 55dffef | 2008-07-03 20:27:50 +0200 | [diff] [blame] | 72 | \fBACCEPT\fP means to let the packet through. |
| 73 | \fBDROP\fP means to drop the packet on the floor. |
| 74 | \fBQUEUE\fP means to pass the packet to userspace. |
| 75 | (How the packet can be received |
Harald Welte | 7bdfca4 | 2005-07-28 15:24:02 +0000 | [diff] [blame] | 76 | by a userspace process differs by the particular queue handler. 2.4.x |
Jan Engelhardt | 55dffef | 2008-07-03 20:27:50 +0200 | [diff] [blame] | 77 | and 2.6.x kernels up to 2.6.13 include the \fBip_queue\fP |
| 78 | queue handler. Kernels 2.6.14 and later additionally include the |
| 79 | \fBnfnetlink_queue\fP queue handler. Packets with a target of QUEUE will be |
| 80 | sent to queue number '0' in this case. Please also see the \fBNFQUEUE\fP |
Harald Welte | 7bdfca4 | 2005-07-28 15:24:02 +0000 | [diff] [blame] | 81 | target as described later in this man page.) |
Jan Engelhardt | 55dffef | 2008-07-03 20:27:50 +0200 | [diff] [blame] | 82 | \fBRETURN\fP means stop traversing this chain and resume at the next |
| 83 | rule in the |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 84 | previous (calling) chain. If the end of a built-in chain is reached |
Jan Engelhardt | 55dffef | 2008-07-03 20:27:50 +0200 | [diff] [blame] | 85 | or a rule in a built-in chain with target \fBRETURN\fP |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 86 | is matched, the target specified by the chain policy determines the |
| 87 | fate of the packet. |
| 88 | .SH TABLES |
| 89 | There are currently three independent tables (which tables are present |
| 90 | at any time depends on the kernel configuration options and which |
| 91 | modules are present). |
| 92 | .TP |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 93 | \fB\-t\fP, \fB\-\-table\fP \fItable\fP |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 94 | This option specifies the packet matching table which the command |
| 95 | should operate on. If the kernel is configured with automatic module |
| 96 | loading, an attempt will be made to load the appropriate module for |
| 97 | that table if it is not already there. |
| 98 | |
| 99 | The tables are as follows: |
| 100 | .RS |
| 101 | .TP .4i |
Jan Engelhardt | 55dffef | 2008-07-03 20:27:50 +0200 | [diff] [blame] | 102 | \fBfilter\fP: |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 103 | This is the default table (if no \-t option is passed). It contains |
Jan Engelhardt | 55dffef | 2008-07-03 20:27:50 +0200 | [diff] [blame] | 104 | the built-in chains \fBINPUT\fP (for packets destined to local sockets), |
| 105 | \fBFORWARD\fP (for packets being routed through the box), and |
| 106 | \fBOUTPUT\fP (for locally-generated packets). |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 107 | .TP |
Jan Engelhardt | 55dffef | 2008-07-03 20:27:50 +0200 | [diff] [blame] | 108 | \fBnat\fP: |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 109 | This table is consulted when a packet that creates a new |
Jan Engelhardt | 55dffef | 2008-07-03 20:27:50 +0200 | [diff] [blame] | 110 | connection is encountered. It consists of three built-ins: \fBPREROUTING\fP |
| 111 | (for altering packets as soon as they come in), \fBOUTPUT\fP |
| 112 | (for altering locally-generated packets before routing), and \fBPOSTROUTING\fP |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 113 | (for altering packets as they are about to go out). |
| 114 | .TP |
Jan Engelhardt | 55dffef | 2008-07-03 20:27:50 +0200 | [diff] [blame] | 115 | \fBmangle\fP: |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 116 | This table is used for specialized packet alteration. Until kernel |
Jan Engelhardt | 55dffef | 2008-07-03 20:27:50 +0200 | [diff] [blame] | 117 | 2.4.17 it had two built-in chains: \fBPREROUTING\fP |
| 118 | (for altering incoming packets before routing) and \fBOUTPUT\fP |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 119 | (for altering locally-generated packets before routing). |
| 120 | Since kernel 2.4.18, three other built-in chains are also supported: |
Jan Engelhardt | 55dffef | 2008-07-03 20:27:50 +0200 | [diff] [blame] | 121 | \fBINPUT\fP (for packets coming into the box itself), \fBFORWARD\fP |
| 122 | (for altering packets being routed through the box), and \fBPOSTROUTING\fP |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 123 | (for altering packets as they are about to go out). |
Harald Welte | a188599 | 2004-10-06 12:32:54 +0000 | [diff] [blame] | 124 | .TP |
Jan Engelhardt | 55dffef | 2008-07-03 20:27:50 +0200 | [diff] [blame] | 125 | \fBraw\fP: |
Harald Welte | a188599 | 2004-10-06 12:32:54 +0000 | [diff] [blame] | 126 | This table is used mainly for configuring exemptions from connection |
| 127 | tracking in combination with the NOTRACK target. It registers at the netfilter |
| 128 | hooks with higher priority and is thus called before ip_conntrack, or any other |
Jan Engelhardt | 55dffef | 2008-07-03 20:27:50 +0200 | [diff] [blame] | 129 | IP tables. It provides the following built-in chains: \fBPREROUTING\fP |
| 130 | (for packets arriving via any network interface) \fBOUTPUT\fP |
Harald Welte | a188599 | 2004-10-06 12:32:54 +0000 | [diff] [blame] | 131 | (for packets generated by local processes) |
Mark Montague | df37d99 | 2011-04-04 14:54:52 +0200 | [diff] [blame] | 132 | .TP |
| 133 | \fBsecurity\fP: |
| 134 | This table is used for Mandatory Access Control (MAC) networking rules, such |
| 135 | as those enabled by the \fBSECMARK\fP and \fBCONNSECMARK\fP targets. |
| 136 | Mandatory Access Control is implemented by Linux Security Modules such as |
| 137 | SELinux. The security table is called after the filter table, allowing any |
| 138 | Discretionary Access Control (DAC) rules in the filter table to take effect |
| 139 | before MAC rules. This table provides the following built-in chains: |
| 140 | \fBINPUT\fP (for packets coming into the box itself), |
| 141 | \fBOUTPUT\fP (for altering locally-generated packets before routing), and |
| 142 | \fBFORWARD\fP (for altering packets being routed through the box). |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 143 | .RE |
| 144 | .SH OPTIONS |
| 145 | The options that are recognized by |
Jan Engelhardt | 55dffef | 2008-07-03 20:27:50 +0200 | [diff] [blame] | 146 | \fBiptables\fP can be divided into several different groups. |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 147 | .SS COMMANDS |
Jan Engelhardt | 6cf172e | 2008-03-10 17:48:59 +0100 | [diff] [blame] | 148 | These options specify the desired action to perform. Only one of them |
| 149 | can be specified on the command line unless otherwise stated |
| 150 | below. For long versions of the command and option names, you |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 151 | need to use only enough letters to ensure that |
Jan Engelhardt | 55dffef | 2008-07-03 20:27:50 +0200 | [diff] [blame] | 152 | \fBiptables\fP can differentiate it from all other options. |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 153 | .TP |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 154 | \fB\-A\fP, \fB\-\-append\fP \fIchain rule-specification\fP |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 155 | Append one or more rules to the end of the selected chain. |
| 156 | When the source and/or destination names resolve to more than one |
| 157 | address, a rule will be added for each possible address combination. |
| 158 | .TP |
Stefan Tomanek | d59b9db | 2011-03-08 22:42:51 +0100 | [diff] [blame] | 159 | \fB\-C\fP, \fB\-\-check\fP \fIchain rule-specification\fP |
| 160 | Check whether a rule matching the specification does exist in the |
| 161 | selected chain. This command uses the same logic as \fB\-D\fP to |
| 162 | find a matching entry, but does not alter the existing iptables |
| 163 | configuration and uses its exit code to indicate success or failure. |
| 164 | .TP |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 165 | \fB\-D\fP, \fB\-\-delete\fP \fIchain rule-specification\fP |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 166 | .ns |
| 167 | .TP |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 168 | \fB\-D\fP, \fB\-\-delete\fP \fIchain rulenum\fP |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 169 | Delete one or more rules from the selected chain. There are two |
| 170 | versions of this command: the rule can be specified as a number in the |
| 171 | chain (starting at 1 for the first rule) or a rule to match. |
| 172 | .TP |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 173 | \fB\-I\fP, \fB\-\-insert\fP \fIchain\fP [\fIrulenum\fP] \fIrule-specification\fP |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 174 | Insert one or more rules in the selected chain as the given rule |
| 175 | number. So, if the rule number is 1, the rule or rules are inserted |
| 176 | at the head of the chain. This is also the default if no rule number |
| 177 | is specified. |
| 178 | .TP |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 179 | \fB\-R\fP, \fB\-\-replace\fP \fIchain rulenum rule-specification\fP |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 180 | Replace a rule in the selected chain. If the source and/or |
| 181 | destination names resolve to multiple addresses, the command will |
| 182 | fail. Rules are numbered starting at 1. |
| 183 | .TP |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 184 | \fB\-L\fP, \fB\-\-list\fP [\fIchain\fP] |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 185 | List all rules in the selected chain. If no chain is selected, all |
Jan Engelhardt | 6cf172e | 2008-03-10 17:48:59 +0100 | [diff] [blame] | 186 | chains are listed. Like every other iptables command, it applies to the |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 187 | specified table (filter is the default), so NAT rules get listed by |
| 188 | .nf |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 189 | iptables \-t nat \-n \-L |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 190 | .fi |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 191 | Please note that it is often used with the \fB\-n\fP |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 192 | option, in order to avoid long reverse DNS lookups. |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 193 | It is legal to specify the \fB\-Z\fP |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 194 | (zero) option as well, in which case the chain(s) will be atomically |
| 195 | listed and zeroed. The exact output is affected by the other |
| 196 | arguments given. The exact rules are suppressed until you use |
| 197 | .nf |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 198 | iptables \-L \-v |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 199 | .fi |
| 200 | .TP |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 201 | \fB\-S\fP, \fB\-\-list\-rules\fP [\fIchain\fP] |
Henrik Nordstrom | 96296cf | 2008-05-13 13:08:26 +0200 | [diff] [blame] | 202 | Print all rules in the selected chain. If no chain is selected, all |
Jan Engelhardt | 352ccfb | 2009-08-20 17:15:22 +0200 | [diff] [blame] | 203 | chains are printed like iptables-save. Like every other iptables command, |
Henrik Nordstrom | 96296cf | 2008-05-13 13:08:26 +0200 | [diff] [blame] | 204 | it applies to the specified table (filter is the default). |
| 205 | .TP |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 206 | \fB\-F\fP, \fB\-\-flush\fP [\fIchain\fP] |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 207 | Flush the selected chain (all the chains in the table if none is given). |
| 208 | This is equivalent to deleting all the rules one by one. |
| 209 | .TP |
Jan Engelhardt | fe086ba | 2009-08-19 22:36:03 +0200 | [diff] [blame] | 210 | \fB\-Z\fP, \fB\-\-zero\fP [\fIchain\fP [\fIrulenum\fP]] |
| 211 | Zero the packet and byte counters in all chains, or only the given chain, |
| 212 | or only the given rule in a chain. It is legal to |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 213 | specify the |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 214 | \fB\-L\fP, \fB\-\-list\fP |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 215 | (list) option as well, to see the counters immediately before they are |
| 216 | cleared. (See above.) |
| 217 | .TP |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 218 | \fB\-N\fP, \fB\-\-new\-chain\fP \fIchain\fP |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 219 | Create a new user-defined chain by the given name. There must be no |
| 220 | target of that name already. |
| 221 | .TP |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 222 | \fB\-X\fP, \fB\-\-delete\-chain\fP [\fIchain\fP] |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 223 | Delete the optional user-defined chain specified. There must be no references |
Harald Welte | 3a02693 | 2005-11-22 22:22:28 +0000 | [diff] [blame] | 224 | to the chain. If there are, you must delete or replace the referring rules |
| 225 | before the chain can be deleted. The chain must be empty, i.e. not contain |
| 226 | any rules. If no argument is given, it will attempt to delete every |
| 227 | non-builtin chain in the table. |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 228 | .TP |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 229 | \fB\-P\fP, \fB\-\-policy\fP \fIchain target\fP |
Jan Engelhardt | 55dffef | 2008-07-03 20:27:50 +0200 | [diff] [blame] | 230 | Set the policy for the chain to the given target. See the section \fBTARGETS\fP |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 231 | for the legal targets. Only built-in (non-user-defined) chains can have |
| 232 | policies, and neither built-in nor user-defined chains can be policy |
| 233 | targets. |
| 234 | .TP |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 235 | \fB\-E\fP, \fB\-\-rename\-chain\fP \fIold\-chain new\-chain\fP |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 236 | Rename the user specified chain to the user supplied name. This is |
| 237 | cosmetic, and has no effect on the structure of the table. |
| 238 | .TP |
Laurence J. Lane | cfb048f | 2009-08-20 17:14:25 +0200 | [diff] [blame] | 239 | \fB\-h\fP |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 240 | Help. |
| 241 | Give a (currently very brief) description of the command syntax. |
| 242 | .SS PARAMETERS |
| 243 | The following parameters make up a rule specification (as used in the |
| 244 | add, delete, insert, replace and append commands). |
| 245 | .TP |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 246 | [\fB!\fP] \fB\-p\fP, \fB\-\-protocol\fP \fIprotocol\fP |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 247 | The protocol of the rule or of the packet to check. |
Jan Engelhardt | 55dffef | 2008-07-03 20:27:50 +0200 | [diff] [blame] | 248 | The specified protocol can be one of \fBtcp\fP, \fBudp\fP, \fBudplite\fP, |
| 249 | \fBicmp\fP, \fBesp\fP, \fBah\fP, \fBsctp\fP or \fBall\fP, |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 250 | or it can be a numeric value, representing one of these protocols or a |
| 251 | different one. A protocol name from /etc/protocols is also allowed. |
| 252 | A "!" argument before the protocol inverts the |
Jan Engelhardt | 55dffef | 2008-07-03 20:27:50 +0200 | [diff] [blame] | 253 | test. The number zero is equivalent to \fBall\fP. |
| 254 | Protocol \fBall\fP |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 255 | will match with all protocols and is taken as default when this |
| 256 | option is omitted. |
| 257 | .TP |
Michael Granzow | 332e4ac | 2009-04-09 18:24:36 +0100 | [diff] [blame] | 258 | [\fB!\fP] \fB\-s\fP, \fB\-\-source\fP \fIaddress\fP[\fB/\fP\fImask\fP][\fB,\fP\fI...\fP] |
Jan Engelhardt | 55dffef | 2008-07-03 20:27:50 +0200 | [diff] [blame] | 259 | Source specification. \fIAddress\fP |
Jan Engelhardt | 1bd2f0a | 2009-11-18 00:00:37 +0100 | [diff] [blame] | 260 | can be either a network name, a hostname, a network IP address (with |
| 261 | \fB/\fP\fImask\fP), or a plain IP address. Hostnames will |
| 262 | be resolved once only, before the rule is submitted to the kernel. |
| 263 | Please note that specifying any name to be resolved with a remote query such as |
| 264 | DNS is a really bad idea. |
Jan Engelhardt | 55dffef | 2008-07-03 20:27:50 +0200 | [diff] [blame] | 265 | The \fImask\fP |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 266 | can be either a network mask or a plain number, |
| 267 | specifying the number of 1's at the left side of the network mask. |
Jan Engelhardt | 55dffef | 2008-07-03 20:27:50 +0200 | [diff] [blame] | 268 | Thus, a mask of \fI24\fP is equivalent to \fI255.255.255.0\fP. |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 269 | A "!" argument before the address specification inverts the sense of |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 270 | the address. The flag \fB\-\-src\fP is an alias for this option. |
Michael Granzow | 332e4ac | 2009-04-09 18:24:36 +0100 | [diff] [blame] | 271 | Multiple addresses can be specified, but this will \fBexpand to multiple |
| 272 | rules\fP (when adding with \-A), or will cause multiple rules to be |
| 273 | deleted (with \-D). |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 274 | .TP |
Michael Granzow | 332e4ac | 2009-04-09 18:24:36 +0100 | [diff] [blame] | 275 | [\fB!\fP] \fB\-d\fP, \fB\-\-destination\fP \fIaddress\fP[\fB/\fP\fImask\fP][\fB,\fP\fI...\fP] |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 276 | Destination specification. |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 277 | See the description of the \fB\-s\fP |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 278 | (source) flag for a detailed description of the syntax. The flag |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 279 | \fB\-\-dst\fP is an alias for this option. |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 280 | .TP |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 281 | \fB\-j\fP, \fB\-\-jump\fP \fItarget\fP |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 282 | This specifies the target of the rule; i.e., what to do if the packet |
| 283 | matches it. The target can be a user-defined chain (other than the |
| 284 | one this rule is in), one of the special builtin targets which decide |
Jan Engelhardt | 55dffef | 2008-07-03 20:27:50 +0200 | [diff] [blame] | 285 | the fate of the packet immediately, or an extension (see \fBEXTENSIONS\fP |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 286 | below). If this |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 287 | option is omitted in a rule (and \fB\-g\fP |
Henrik Nordstrom | 17fc163 | 2005-11-05 09:26:40 +0000 | [diff] [blame] | 288 | is not used), then matching the rule will have no |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 289 | effect on the packet's fate, but the counters on the rule will be |
| 290 | incremented. |
| 291 | .TP |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 292 | \fB\-g\fP, \fB\-\-goto\fP \fIchain\fP |
Henrik Nordstrom | 17fc163 | 2005-11-05 09:26:40 +0000 | [diff] [blame] | 293 | This specifies that the processing should continue in a user |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 294 | specified chain. Unlike the \-\-jump option return will not continue |
Henrik Nordstrom | 17fc163 | 2005-11-05 09:26:40 +0000 | [diff] [blame] | 295 | processing in this chain but instead in the chain that called us via |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 296 | \-\-jump. |
Henrik Nordstrom | 17fc163 | 2005-11-05 09:26:40 +0000 | [diff] [blame] | 297 | .TP |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 298 | [\fB!\fP] \fB\-i\fP, \fB\-\-in\-interface\fP \fIname\fP |
Matthew Strait | 403cf6a | 2004-03-17 14:26:08 +0000 | [diff] [blame] | 299 | Name of an interface via which a packet was received (only for |
Jan Engelhardt | 55dffef | 2008-07-03 20:27:50 +0200 | [diff] [blame] | 300 | packets entering the \fBINPUT\fP, \fBFORWARD\fP and \fBPREROUTING\fP |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 301 | chains). When the "!" argument is used before the interface name, the |
| 302 | sense is inverted. If the interface name ends in a "+", then any |
| 303 | interface which begins with this name will match. If this option is |
| 304 | omitted, any interface name will match. |
| 305 | .TP |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 306 | [\fB!\fP] \fB\-o\fP, \fB\-\-out\-interface\fP \fIname\fP |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 307 | Name of an interface via which a packet is going to be sent (for packets |
Jan Engelhardt | 55dffef | 2008-07-03 20:27:50 +0200 | [diff] [blame] | 308 | entering the \fBFORWARD\fP, \fBOUTPUT\fP and \fBPOSTROUTING\fP |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 309 | chains). When the "!" argument is used before the interface name, the |
| 310 | sense is inverted. If the interface name ends in a "+", then any |
| 311 | interface which begins with this name will match. If this option is |
| 312 | omitted, any interface name will match. |
| 313 | .TP |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 314 | [\fB!\fP] \fB\-f\fP, \fB\-\-fragment\fP |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 315 | This means that the rule only refers to second and further fragments |
| 316 | of fragmented packets. Since there is no way to tell the source or |
| 317 | destination ports of such a packet (or ICMP type), such a packet will |
| 318 | not match any rules which specify them. When the "!" argument |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 319 | precedes the "\-f" flag, the rule will only match head fragments, or |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 320 | unfragmented packets. |
| 321 | .TP |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 322 | \fB\-c\fP, \fB\-\-set\-counters\fP \fIpackets bytes\fP |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 323 | This enables the administrator to initialize the packet and byte |
Jan Engelhardt | 55dffef | 2008-07-03 20:27:50 +0200 | [diff] [blame] | 324 | counters of a rule (during \fBINSERT\fP, \fBAPPEND\fP, \fBREPLACE\fP |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 325 | operations). |
| 326 | .SS "OTHER OPTIONS" |
| 327 | The following additional options can be specified: |
| 328 | .TP |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 329 | \fB\-v\fP, \fB\-\-verbose\fP |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 330 | Verbose output. This option makes the list command show the interface |
| 331 | name, the rule options (if any), and the TOS masks. The packet and |
| 332 | byte counters are also listed, with the suffix 'K', 'M' or 'G' for |
| 333 | 1000, 1,000,000 and 1,000,000,000 multipliers respectively (but see |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 334 | the \fB\-x\fP flag to change this). |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 335 | For appending, insertion, deletion and replacement, this causes |
| 336 | detailed information on the rule or rules to be printed. |
| 337 | .TP |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 338 | \fB\-n\fP, \fB\-\-numeric\fP |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 339 | Numeric output. |
| 340 | IP addresses and port numbers will be printed in numeric format. |
| 341 | By default, the program will try to display them as host names, |
| 342 | network names, or services (whenever applicable). |
| 343 | .TP |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 344 | \fB\-x\fP, \fB\-\-exact\fP |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 345 | Expand numbers. |
| 346 | Display the exact value of the packet and byte counters, |
| 347 | instead of only the rounded number in K's (multiples of 1000) |
| 348 | M's (multiples of 1000K) or G's (multiples of 1000M). This option is |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 349 | only relevant for the \fB\-L\fP command. |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 350 | .TP |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 351 | \fB\-\-line\-numbers\fP |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 352 | When listing rules, add line numbers to the beginning of each rule, |
| 353 | corresponding to that rule's position in the chain. |
| 354 | .TP |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 355 | \fB\-\-modprobe=\fP\fIcommand\fP |
Jan Engelhardt | 55dffef | 2008-07-03 20:27:50 +0200 | [diff] [blame] | 356 | When adding or inserting rules into a chain, use \fIcommand\fP |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 357 | to load any necessary modules (targets, match extensions, etc). |
| 358 | .SH MATCH EXTENSIONS |
| 359 | iptables can use extended packet matching modules. These are loaded |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 360 | in two ways: implicitly, when \fB\-p\fP or \fB\-\-protocol\fP |
| 361 | is specified, or with the \fB\-m\fP or \fB\-\-match\fP |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 362 | options, followed by the matching module name; after these, various |
| 363 | extra command line options become available, depending on the specific |
| 364 | module. You can specify multiple extended match modules in one line, |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 365 | and you can use the \fB\-h\fP or \fB\-\-help\fP |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 366 | options after the module has been specified to receive help specific |
| 367 | to that module. |
Jan Engelhardt | 0c2b5a4 | 2009-01-08 18:04:40 +0100 | [diff] [blame] | 368 | .PP |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 369 | The following are included in the base package, and most of these can |
Jan Engelhardt | 55dffef | 2008-07-03 20:27:50 +0200 | [diff] [blame] | 370 | be preceded by a "\fB!\fP" to invert the sense of the match. |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 371 | .\" @MATCH@ |
| 372 | .SH TARGET EXTENSIONS |
| 373 | iptables can use extended target modules: the following are included |
| 374 | in the standard distribution. |
| 375 | .\" @TARGET@ |
| 376 | .SH DIAGNOSTICS |
| 377 | Various error messages are printed to standard error. The exit code |
| 378 | is 0 for correct functioning. Errors which appear to be caused by |
| 379 | invalid or abused command line parameters cause an exit code of 2, and |
| 380 | other errors cause an exit code of 1. |
| 381 | .SH BUGS |
| 382 | Bugs? What's this? ;-) |
Harald Welte | 64d900f | 2005-06-24 16:37:00 +0000 | [diff] [blame] | 383 | Well, you might want to have a look at http://bugzilla.netfilter.org/ |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 384 | .SH COMPATIBILITY WITH IPCHAINS |
Jan Engelhardt | 55dffef | 2008-07-03 20:27:50 +0200 | [diff] [blame] | 385 | This \fBiptables\fP |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 386 | is very similar to ipchains by Rusty Russell. The main difference is |
Jan Engelhardt | 55dffef | 2008-07-03 20:27:50 +0200 | [diff] [blame] | 387 | that the chains \fBINPUT\fP and \fBOUTPUT\fP |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 388 | are only traversed for packets coming into the local host and |
| 389 | originating from the local host respectively. Hence every packet only |
| 390 | passes through one of the three chains (except loopback traffic, which |
| 391 | involves both INPUT and OUTPUT chains); previously a forwarded packet |
| 392 | would pass through all three. |
| 393 | .PP |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 394 | The other main difference is that \fB\-i\fP refers to the input interface; |
| 395 | \fB\-o\fP refers to the output interface, and both are available for packets |
Jan Engelhardt | 55dffef | 2008-07-03 20:27:50 +0200 | [diff] [blame] | 396 | entering the \fBFORWARD\fP chain. |
| 397 | .PP |
| 398 | The various forms of NAT have been separated out; \fBiptables\fP |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 399 | is a pure packet filter when using the default `filter' table, with |
| 400 | optional extension modules. This should simplify much of the previous |
| 401 | confusion over the combination of IP masquerading and packet filtering |
| 402 | seen previously. So the following options are handled differently: |
| 403 | .nf |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 404 | \-j MASQ |
| 405 | \-M \-S |
| 406 | \-M \-L |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 407 | .fi |
| 408 | There are several other changes in iptables. |
| 409 | .SH SEE ALSO |
Jan Engelhardt | 0e8984a | 2009-01-12 07:06:12 +0100 | [diff] [blame] | 410 | \fBiptables\-save\fP(8), |
| 411 | \fBiptables\-restore\fP(8), |
| 412 | \fBip6tables\fP(8), |
| 413 | \fBip6tables\-save\fP(8), |
| 414 | \fBip6tables\-restore\fP(8), |
| 415 | \fBlibipq\fP(3). |
| 416 | .PP |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 417 | The packet-filtering-HOWTO details iptables usage for |
| 418 | packet filtering, the NAT-HOWTO details NAT, |
| 419 | the netfilter-extensions-HOWTO details the extensions that are |
| 420 | not in the standard distribution, |
| 421 | and the netfilter-hacking-HOWTO details the netfilter internals. |
| 422 | .br |
| 423 | See |
| 424 | .BR "http://www.netfilter.org/" . |
| 425 | .SH AUTHORS |
Harald Welte | 7bdfca4 | 2005-07-28 15:24:02 +0000 | [diff] [blame] | 426 | Rusty Russell originally wrote iptables, in early consultation with Michael |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 427 | Neuling. |
| 428 | .PP |
| 429 | Marc Boucher made Rusty abandon ipnatctl by lobbying for a generic packet |
| 430 | selection framework in iptables, then wrote the mangle table, the owner match, |
| 431 | the mark stuff, and ran around doing cool stuff everywhere. |
| 432 | .PP |
| 433 | James Morris wrote the TOS target, and tos match. |
| 434 | .PP |
| 435 | Jozsef Kadlecsik wrote the REJECT target. |
| 436 | .PP |
Harald Welte | 7bdfca4 | 2005-07-28 15:24:02 +0000 | [diff] [blame] | 437 | Harald Welte wrote the ULOG and NFQUEUE target, the new libiptc, as well as the TTL, DSCP, ECN matches and targets. |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 438 | .PP |
Patrick McHardy | 110a89a | 2007-01-28 01:24:55 +0000 | [diff] [blame] | 439 | The Netfilter Core Team is: Marc Boucher, Martin Josefsson, Yasuyuki Kozakai, |
Yasuyuki KOZAKAI | e605d76 | 2007-02-15 06:41:58 +0000 | [diff] [blame] | 440 | Jozsef Kadlecsik, Patrick McHardy, James Morris, Pablo Neira Ayuso, |
| 441 | Harald Welte and Rusty Russell. |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 442 | .PP |
Harald Welte | 7bdfca4 | 2005-07-28 15:24:02 +0000 | [diff] [blame] | 443 | Man page originally written by Herve Eychenne <rv@wallfire.org>. |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 444 | .\" .. and did I mention that we are incredibly cool people? |
| 445 | .\" .. sexy, too .. |
| 446 | .\" .. witty, charming, powerful .. |
| 447 | .\" .. and most of all, modest .. |
Jan Engelhardt | f96cb80 | 2011-03-01 12:51:21 +0100 | [diff] [blame] | 448 | .SH VERSION |
| 449 | .PP |
| 450 | This manual page applies to iptables @PACKAGE_VERSION@. |