like "/usr/sbin/iptables".

The address type checking can be limited to the interface the packet is coming in.

The address type checking can be limited to the interface the packet is going out.

Matches if the destination address is of given type.

Matches if the source address is of given type.

Matches if the reserved field is filled with zero.

This option takes mostly 2 spis, (min) or (min, max) Matches SPI.

Total length of this header in octets.

Pass the BPF byte code format.

Pass a path to a pinned eBPF object.

Match corresponding cgroup for this packet.

Match cgroup2 membership.

Set seed value of the Jenkins hash.

Set the local node number ID.

Set the local node number ID mask.

Set number of total nodes in cluster.

Match packets from a connection whose packets/bytes/average packet size is more than FROM and less than TO bytes/packets.

Which packets to consider.

Whether to check the amount of packets, number of bytes transferred or the average size (in bytes) of all packets received so far.

Matches if label number has been set on a connection.

Matches if label name has been set on a connection.

If the label has not been set on the connection, set it.

Match if the number of existing connections is above n.

Apply the limit onto the destination group.

Group hosts using the prefix length.

Apply the limit onto the source group.

Match if the number of existing connections is below or equal n.

This option takes mostly 2 time, (min) or (min, max).

This option takes mostly 2 ports, (min) or (min, max).

This option takes mostly 2 ports, (min) or (min, max).

Layer-4 protocol to match.

This option takes mostly 2 ports, (min) or (min, max).

This option takes mostly 2 ports, (min) or (min, max).

Match if DCCP option set.

This option takes mostly 2 ports, (min) or (min, max).

Match when the DCCP packet type in types.

This option takes mostly 2 ports, (min) or (min, max).

Match device group of outgoing device.

Match device group of incoming device.

Match against a numeric value [0-63].

Total length of this header in octets.

Numeric type of option and the length of the option data in octets.

This matches if the TCP ECN CWR (Congestion Window Received) bit is set.

This matches if the TCP ECN ECE (ECN Echo) bit is set.

This matches a particular IPv4/IPv6 ECT (ECN-Capable Transport).

Matches on the first fragment.

This option takes mostly 2 ids, (min) or (min, max) Matches the given Identification or range of it.

Matches if this is the last fragment.

This option cannot be used with kernel version 2.6.10 or later.

Matches if there are more fragments.

Matches if the reserved fields are filled with zero.

Match if the rate is above amount/quantum.

Maximum initial number of packets to match: this number gets recharged by one every time the limit specified above is not reached, up to this number; the default is 5.

All destination addresses encountered will be grouped according to the given prefix length and the so-created subnet will be subject to hashlimit.

After how many milliseconds do hash entries expire.

How many milliseconds between garbage collection intervals.

The number of buckets of the hash table.

The number of buckets of the hash table.

A comma-separated list of objects to take into consideration.

The name for the /proc/net/ipt_hashlimit/xxx entry.

All source addresses encountered will be grouped according to the given prefix length and the so-created subnet will be subject to hashlimit.

Match if the rate is below or equal to amount/quantum.

Total length of this header in octets.

Numeric type of option and the length of the option data in octets.

This option takes mostly 2 ips, (min) or (min, max) Match destination IP in the specified range.

This option takes mostly 2 ips, (min) or (min, max) Match source IP in the specified range.

Matches the packet which EXACTLY includes all specified headers.

Matches if the packet includes any of the headers specified with WithMatchIPv6Header.

Packet belongs to an IPVS connection.

Maximum average matching rate.

Maximum initial number of packets to match.

Match if the destination port is one of the given ports.

Match if either the source or destination ports are equal to one of the given ports.

Match if the source port is one of the given ports.

Match an operating system genre by using a passive fingerprinting.

Log determined genres into dmesg even if they do not match the desired one.

Do additional TTL checks on the packet to determine the operating system.

Matches if the packet socket's file structure is owned by the given group.

Matches if the packet socket's file structure is owned by the given group.

Matches if the packet is associated with a socket.

Group to be also checked in the supplementary groups of a process.

Matches if the packet socket's file structure (if it has one) is owned by the given user.

Matches if the packet socket's file structure (if it has one) is owned by the given user.

Name of a bridge port via which a packet is received.

Matches if the packet has entered through a bridge interface.

Matches if the packet will leave through a bridge interface.

Name of a bridge port via which a packet is going to be sent.

Matches if the packet is subject to IPsec processing.

Used to select whether to match the policy used for decapsulation or the policy that will be used for encapsulation.

Selects whether to match the exact policy or match if any rule of the policy matches the given policy.

The names of the two rate estimators for relative mode.

The names of the two rate estimators for relative mode.

For each estimator (either absolute or relative mode), calculate the difference between the estimator-determined flow rate and the static value chosen with the BPS/PPS options.

Name of the one rate estimator for absolute mode.

LT, GT or EQ.

Check if the source address of the packet is currently in the list.

see iptables-extensions.

Specify the list to use for the commands.

Match/save the destination address of each packet in the recent list table.

This option can only be used in conjunction with Seconds.

Check if the source address of the packet is currently in the list and if so that address will be removed from the list and the rule will return true.

Match/save the source address of each packet in the recent list table.

This option must be used in conjunction with one of Check or Update.

This will add the source address of the packet to the list.

Like WithMatchRecentCheck, except it will update the "last seen" timestamp if it matches.

This will permit packets arriving from the network with a source address that is also assigned to the local machine.

This will invert the sense of the match.

Used to specify that the reverse path filter test should match even if the selected output device is not the expected one.

Also use the packets' nfmark value when performing the reverse path route lookup.

Match addresses when type == 0.

Match the length of this header.

List of addresses is not a strict list when type == 0.

Match the reserved field when type == 0.

Takes mostly 2 values, (min) or (min, max) Match the `segments left' field (range).

see iptables-extensions.

Match the type.

This option takes mostly 2 ports, (min) or (min, max).

This option takes mostly 2 ports, (min) or (min, max).

There can be at least on and no more than six of flags.

Default the packet and byte counters are updated, use this function to skip.

Do not ignore sockets bound to 'any' address.

Ignore non-transparent sockets.

Match one packet every nth packet.

Set the matching mode of the matching rule.

Set the initial counter value for the nth mode.

Set the probability for a packet to be randomly matched.

Select the pattern matching strategy.

Set the offset from which it starts looking for any matching.

Matches the given pattern in hex notation.

Matches the given pattern.

Set the offset up to which should be scanned.

This option takes mostly 2 ports, (min) or (min, max).

Match when the TCP flags are as specified.

This option takes mostly 2 ports, (min) or (min, max).

Match this as a single time period instead distinct intervals.

Use the kernel timezone instead of UTC to determine whether a packet meets the time regulations.

Match on the given days of the month.

Match not on the given days of the month.

Match not on the given weekdays.

Match on the given weekdays.

Matches the given TTL value.

Matches if TTL is greater than the given TTL value.

Matches if TTL is less than the given TTL value.

Doesn't match the given TTL value.

This option takes mostly 2 ports, (min) or (min, max).

This option takes mostly 2 ports, (min) or (min, max).

VIP address to match.

Flow direction of packet.

IPVS forwarding method used.

VIP port to match.

VIP port of the controlling connection to match.

VIP protocol to match.

Specify the random seed used for hash initialization.

Specify the hashing mode.

Local node number within this cluster.

Specify the ClusterIP MAC address.

Create a new ClusterIP.

Number of total nodes within this cluster.

Binary AND the ctmark with bits.

Binary OR the ctmark with bits.

Copy the connection mark (ctmark) to the packet mark (nfmark) using the given masks.

Copy the packet mark (nfmark) to the connection mark (ctmark) using the given masks.

Set the connection mark.

This option takes mostly 2 value, (value) or (value, mask) Zero out the bits given by mask and XOR value into the ctmark.

Binary XOR the ctmark with bits.

Only generate the specified conntrack events for this connection.

Only generate the specified expectation events for this connection.

Use the helper identified by name for the connection.

Disables connection tracking for this packet.

Use the timeout policy identified by name for the connection.

The zone is derived from the packet nfmark.

The zone is derived from the packet nfmark.

The zone is derived from the packet nfmark.

To set addr nil or port -1 means empty.

Target against a numeric value [0-63].

A 16 bit destination port mask in hexadecimal.

The destination address mask in CIDR notation.

Modulus for hash calculation (to limit the range of possible marks).

Offset to start marks from.

An 8 bit field with layer 4 protocol number.

A 32 bit random custom value to feed hash calculation.

A 32 bit field with spi mask.

A 16 bit source port mask in hexadecimal.

The source address mask in CIDR notation.

This is a unique identifier for the timer.

This is the time in seconds that will trigger the notification.

Always make the LED blink on packet arrival, even if the LED is already on.

This indicates how long (in milliseconds) the LED should be left illuminated when a packet arrives before being switched off again.

This is the name given to the LED trigger.

Binary AND the ctmark with bits.

Binary OR the ctmark with bits.

Zeroes out the bits given by mask and ORs value into the packet mark.

This option takes mostly 2 value, (value) or (value, mask) Zero out the bits given by mask and XOR value into the ctmark.

Binary XOR the ctmark with bits.

This option takes mostly 2 ports, (min) or (min, max).

Network address to map to.

The netlink group (0 - 2^16-1) to which packets are (only applicable for nfnetlink_log).

A prefix string to include in the log message, up to 64 characters long, useful for distinguishing messages in the logs.

This option has never worked, use NFLogSize instead.

The number of bytes to be copied to userspace (only applicable for nfnetlink_log).

Number of packets to queue inside the kernel before sending them to userspace (only applicable for nfnetlink_log).

This specifies a range of queues to use.

By default, if no userspace program is listening on an NFQUEUE, then all packets that are to be queued are dropped.

Available starting Linux kernel 3.10.

This specifies the QUEUE number to use.

Rate measurement averaging time constant.

Rate measurement interval, in seconds, milliseconds or microseconds.

Count matched packets into the pool referred to by name, which is freely choosable.

This option takes mostly 2 ports, (min) or (min, max).

This option takes mostly 2 addrs, (min) or (min, max).

To set addr nil or port -1 means empty.

Maximum segment size announced to clients.

Pass client selective acknowledgement option to backend (will be disabled if not present).

Pass client timestamp option to backend (will be disabled if not present, also needed for selective acknowledgement and window scaling).

Window scale announced to clients.

Explicitly sets MSS option to specified value.

Strip the given option(s).

This option takes mostly 2 tos, (value) or (value/mask).

This specifies a destination address to use.

This specifies a destination port to use.

Number of bytes to be copied to userspace.

This specifies the netlink group (1-32) to which the packet is sent.

Prefix log messages with the specified prefix; up to 32 characters long, and useful for distinguishing messages in the logs.

Number of packet to queue inside kernel.

append.

check.

delete.

delete_chain.

as iptables list_rules.

go-xtables support.

flush.

insert.

list.

go-xtables support.

go-xtables support.

new_chain.

policy.

rename_chain.

replace.

zero.

mode.

IPv6.

IPv4.

action must be taken immediately */.

critical conditions */.

debug-level messages */.

system is unusable */.

error conditions */.

informational */.

normal but significant condition */.

warning conditions */.

Both IPv4 & IPv6 specific.

option.

IPv6-specific.

IPv6-specific.

IPv6-specific.

IPv6-specific, Hop-by-Hop.

IPv6-specific, Hop Limit.

both IPv6 & IPv4-specific.

option.

option.

option.

IPv6-specific.

IPv6-specific.

option.

option.

IPv4-specific.

IPv6-specific.

option.

unsupport.

IPv4-specific.

unsupport.

filter.

mangle.

nat.

raw.

security.

goto chain.

jump chain.

unsupport.

unsupport.

Both.

unspecified.

BPF.

Non-numeric unsupported.

Both ipv4 and ipv6 Non-numeric unsupported.

Non-numeric unsupported.

Non-numeric unsupported.

Non-numeric unsupported.

Non-numeric unsupported.

Non-numeric unsupported.

Numeric unsupported.

Non-numeric unsupported.

Non-numeric unsupported.

Non-numeric supported.

Non-numeric unsupport.

Non-numeric support.

IPv6 specific Non-numeric unsupport.

IPv6 specific Non-numeric unsupport.

IPv6 specific Non-numeric unsupport.

IPv6 specific Non-numeric unsupport.

IPv6 and IPv4 specific Non-numeric support.

IPv6 specific Non-numeric support.

IPv6 specific Non-numeric support.

The field won't be use must be set to -1.

IPv4 specific Non-numeric support see http://linux-ip.net/gl/ip-cref/ip-cref-node172.html.

IPv6 specific Non-numeric unsupport.

IPv4 specific Non-numeric unsupport.

Display the exact value of the packet and byte counters, instead of only the rounded number in K's(multiples of 1000) M's(multiples of 1000K) or G's(multiples of 1000M).

List with line numbers of each rule, corresponding to that rule's position in the chain.

When adding or inserting rule into a chain, use command to load any necessary modules(targets, match extensions, etc).

0 for End means ignoring.

IPv4 specific.

IPv6 specific.

IPv4 specific.

IPv6 specific.

TODO untested in the real world IPv4 specific.

TODO untested in the real world.

IPv6 specific.

IPv4 specific.

TODO untested in the real world IPv4 specific Deprecated.

see https://git.netfilter.org/iptables/tree/extensions/dscp_helper.c.