iptables can use extended packet matching modules. These are loaded in
two ways: implicitly, when -p or --protocol is specified, or with the
-m or --match options, followed by the matching module name; after
these, various extra command line options become available, depending
on the specific module. You can specify multiple extended match mod-
ules in one line, and you can use the -h or --help options after the
module has been specified to receive help specific to that module.
The following are included in the base package, and most of these can
be preceded by a ! to invert the sense of the match.
addrtype
This module matches packets based on their address type. Address types
are used within the kernel networking stack and categorize addresses
into various groups. The exact definition of that group depends on the
specific layer three protocol.
The following address types are possible:
UNSPEC an unspecified address (i.e. 0.0.0.0) UNICAST an unicast address
LOCAL a local address BROADCAST a broadcast address ANYCAST an
anycast packet MULTICAST a multicast address BLACKHOLE a black-
hole address UNREACHABLE an unreachable address PROHIBIT a pro-
hibited address THROW FIXME NAT FIXME XRESOLVE FIXME
--src-type type
Matches if the source address is of given type
--dst-type type
Matches if the destination address is of given type
ah
This module matches the SPIs in AH header of IPSec packets.
--ahspi [!] spi[:spi]
childlevel
This is an experimental module. It matches on whether the packet is
part of a master connection or one of its children (or grandchildren,
etc). For instance, most packets are level 0. FTP data transfer is
level 1.
--childlevel [!] level
condition
This matches if a specific /proc filename is ’0’ or ’1’.
--condition [!] filename
Match on boolean value stored in /proc/net/ipt_condition/file-
name file
connmark
This module matches the netfilter mark field associated with a connec-
tion (which can be set using the CONNMARK target below).
--mark value[/mask]
Matches packets in connections with the given mark value (if a
mask is specified, this is logically ANDed with the mark before
the comparison).
connrate
This module matches the current transfer rate in a connection.
--connrate [!] [from]:[to]
Match against the current connection transfer rate being within
’from’ and ’to’ bytes per second. When the "!" argument is used
before the range, the sense of the match is inverted.
conntrack
This module, when combined with connection tracking, allows access to
more connection tracking information than the "state" match. (this
module is present only if iptables was compiled under a kernel support-
ing this feature)
--ctstate state
Where state is a comma separated list of the connection states
to match. Possible states are INVALID meaning that the packet
is associated with no known connection, ESTABLISHED meaning that
the packet is associated with a connection which has seen pack-
ets in both directions, NEW meaning that the packet has started
a new connection, or otherwise associated with a connection
which has not seen packets in both directions, and RELATED mean-
ing that the packet is starting a new connection, but is associ-
ated with an existing connection, such as an FTP data transfer,
or an ICMP error. SNAT A virtual state, matching if the origi-
nal source address differs from the reply destination. DNAT A
virtual state, matching if the original destination differs from
the reply source.
--ctproto proto
Protocol to match (by number or name)
--ctorigsrc [!] address[/mask]
Match against original source address
--ctorigdst [!] address[/mask]
Match against original destination address
--ctreplsrc [!] address[/mask]
Match against reply source address
--ctrepldst [!] address[/mask]
Match against reply destination address
--ctstatus [NONE|EXPECTED|SEEN_REPLY|ASSURED][,...]
Match against internal conntrack states
--ctexpire time[:time]
Match remaining lifetime in seconds against given value or range
of values (inclusive)
dscp
This module matches the 6 bit DSCP field within the TOS field in the IP
header. DSCP has superseded TOS within the IETF.
--dscp value
Match against a numeric (decimal or hex) value [0-32].
--dscp-class DiffServ Class
Match the DiffServ class. This value may be any of the BE, EF,
AFxx or CSx classes. It will then be converted into it’s
according numeric value.
dstlimit
This module allows you to limit the packet per second (pps) rate on a
per destination IP or per destination port base. As opposed to the
‘limit’ match, every destination ip / destination port has it’s own
limit.
--dstlimit avg
Maximum average match rate (packets per second unless followed
by /sec /minute /hour /day postfixes).
--dstlimit-mode mode
The limiting hashmode. Is the specified limit per dstip, dstip-
dstport tuple, srcip-dstip tuple, or per srcipdstip-dstport
tuple.
--dstlimit-name name
Name for /proc/net/ipt_dstlimit/* file entry
[--dstlimit-burst burst]
Number of packets to match in a burst. Default: 5
[--dstlimit-htable-size size]
Number of buckets in the hashtable
[--dstlimit-htable-max max]
Maximum number of entries in the hashtable
[--dstlimit-htable-gcinterval interval]
Interval between garbage collection runs of the hashtable (in
miliseconds). Default is 1000 (1 second).
[--dstlimit-htable-expire time
After which time are idle entries expired from hashtable (in
miliseconds)? Default is 10000 (10 seconds).
ecn
This allows you to match the ECN bits of the IPv4 and TCP header. ECN
is the Explicit Congestion Notification mechanism as specified in
RFC3168
--ecn-tcp-cwr
This matches if the TCP ECN CWR (Congestion Window Received) bit
is set.
--ecn-tcp-ece
This matches if the TCP ECN ECE (ECN Echo) bit is set.
--ecn-ip-ect num
This matches a particular IPv4 ECT (ECN-Capable Transport). You
have to specify a number between ‘0’ and ‘3’.
esp
This module matches the SPIs in ESP header of IPSec packets.
--espspi [!] spi[:spi]
fuzzy
This module matches a rate limit based on a fuzzy logic controller
[FLC]
--lower-limit number"
Specifies the lower limit (in packets per second).
--upper-limit number
Specifies the upper limit (in packets per second).
helper
This module matches packets related to a specific conntrack-helper.
--helper string
Matches packets related to the specified conntrack-helper.
string can be "ftp" for packets related to a ftp-session on
default port. For other ports append -portnr to the value, ie.
"ftp-2121".
Same rules apply for other conntrack-helpers.
icmp
This extension is loaded if ‘--protocol icmp’ is specified. It pro-
vides the following option:
--icmp-type [!] typename
This allows specification of the ICMP type, which can be a
numeric ICMP type, or one of the ICMP type names shown by the
command
iptables -p icmp -h
iprange
This matches on a given arbitrary range of IPv4 addresses
[!]--src-range ip-ip
Match source IP in the specified range.
[!]--dst-range ip-ip
Match destination IP in the specified range.
length
This module matches the length of a packet against a specific value or
range of values.
--length length[:length]
limit
This module matches at a limited rate using a token bucket filter. A
rule using this extension will match until this limit is reached
(unless the ‘!’ flag is used). It can be used in combination with the
LOG target to give limited logging, for example.
--limit rate
Maximum average matching rate: specified as a number, with an
optional ‘/second’, ‘/minute’, ‘/hour’, or ‘/day’ suffix; the
default is 3/hour.
--limit-burst number
Maximum initial number of packets to match: this number gets
recharged by one every time the limit specified above is not
reached, up to this number; the default is 5.
mac
--mac-source [!] address
Match source MAC address. It must be of the form
XX:XX:XX:XX:XX:XX. Note that this only makes sense for packets
coming from an Ethernet device and entering the PREROUTING, FOR-
WARD or INPUT chains.
mark
This module matches the netfilter mark field associated with a packet
(which can be set using the MARK target below).
--mark value[/mask]
Matches packets with the given unsigned mark value (if a mask is
specified, this is logically ANDed with the mask before the com-
parison).
mport
This module matches a set of source or destination ports. Up to 15
ports can be specified. It can only be used in conjunction with -p tcp
or -p udp.
--source-ports port[,port[,port...]]
Match if the source port is one of the given ports. The flag
--sports is a convenient alias for this option.
--destination-ports port[,port[,port...]]
Match if the destination port is one of the given ports. The
flag --dports is a convenient alias for this option.
--ports port[,port[,port...]]
Match if the both the source and destination ports are equal to
each other and to one of the given ports.
multiport
This module matches a set of source or destination ports. Up to 15
ports can be specified. It can only be used in conjunction with -p tcp
or -p udp.
--source-ports port[,port[,port...]]
Match if the source port is one of the given ports. The flag
--sports is a convenient alias for this option.
--destination-ports port[,port[,port...]]
Match if the destination port is one of the given ports. The
flag --dports is a convenient alias for this option.
--ports port[,port[,port...]]
Match if the both the source and destination ports are equal to
each other and to one of the given ports.
nth
This module matches every ‘n’th packet
--every value
Match every ‘value’ packet
[--counter num]
Use internal counter number ‘num’. Default is ‘0’.
[--start num]
Initialize the counter at the number ‘num’ insetad of ‘0’. Most
between ‘0’ and ‘value’-1.
[--packet num]
Match on ‘num’ packet. Most be between ‘0’ and ‘value’-1.
owner
This module attempts to match various characteristics of the packet
creator, for locally-generated packets. It is only valid in the OUTPUT
chain, and even this some packets (such as ICMP ping responses) may
have no owner, and hence never match.
--uid-owner userid
Matches if the packet was created by a process with the given
effective user id.
--gid-owner groupid
Matches if the packet was created by a process with the given
effective group id.
--pid-owner processid
Matches if the packet was created by a process with the given
process id.
--sid-owner sessionid
Matches if the packet was created by a process in the given ses-
sion group.
--cmd-owner name
Matches if the packet was created by a process with the given
command name. (this option is present only if iptables was com-
piled under a kernel supporting this feature)
NOTE: pid, sid and command matching are broken on SMP
physdev
This module matches on the bridge port input and output devices
enslaved to a bridge device. This module is a part of the infrastruc-
ture that enables a transparent bridging IP firewall and is only useful
for kernel versions above version 2.5.44.
--physdev-in name
Name of a bridge port via which a packet is received (only for
packets entering the INPUT, FORWARD and PREROUTING chains). If
the interface name ends in a "+", then any interface which
begins with this name will match. If the packet didn’t arrive
through a bridge device, this packet won’t match this option,
unless ’!’ is used.
--physdev-out name
Name of a bridge port via which a packet is going to be sent
(for packets entering the FORWARD, OUTPUT and POSTROUTING
chains). If the interface name ends in a "+", then any inter-
face which begins with this name will match. Note that in the
nat and mangle OUTPUT chains one cannot match on the bridge out-
put port, however one can in the filter OUTPUT chain. If the
packet won’t leave by a bridge device or it is yet unknown what
the output device will be, then the packet won’t match this
option, unless
--physdev-is-in
Matches if the packet has entered through a bridge interface.
--physdev-is-out
Matches if the packet will leave through a bridge interface.
--physdev-is-bridged
Matches if the packet is being bridged and therefore is not
being routed. This is only useful in the FORWARD and POSTROUT-
ING chains.
pkttype
This module matches the link-layer packet type.
--pkt-type [unicast|broadcast|multicast]
random
This module randomly matches a certain percentage of all packets.
--average percent
Matches the given percentage. If omitted, a probability of 50%
is set.
realm
This matches the routing realm. Routing realms are used in complex
routing setups involving dynamic routing protocols like BGP.
--realm [!]value[/mask]
Matches a given realm number (and optionally mask).
set
This modules macthes IP sets which can be defined by ipset(8).
--set setname flag[,flag...]
where flags are src and/or dst and there can be no more than six
of them. Hence the command
iptables -A FORWARD -m set --set test src,dst
will match packets, for which (depending on the type of the set)
the source address or port number of the packet can be found in
the specified set. If there is a binding belonging to the mached
set element or there is a default binding for the given set,
then the rule will match the packet only if additionally
(depending on the type of the set) the destination address or
port number of the packet can be found in the set according to
the binding.
state
This module, when combined with connection tracking, allows access to
the connection tracking state for this packet.
--state state
Where state is a comma separated list of the connection states
to match. Possible states are INVALID meaning that the packet
could not be identified for some reason which includes running
out of memory and ICMP errors which don’t correspond to any
known connection, ESTABLISHED meaning that the packet is
associated with a connection which has seen packets in both
directions, NEW meaning that the packet has started a new con-
nection, or otherwise associated with a connection which has not
seen packets in both directions, and RELATED meaning that the
packet is starting a new connection, but is associated with an
existing connection, such as an FTP data transfer, or an ICMP
error.
tcp
These extensions are loaded if ‘--protocol tcp’ is specified. It pro-
vides the following options:
--source-port [!] port[:port]
Source port or port range specification. This can either be a
service name or a port number. An inclusive range can also be
specified, using the format port:port. If the first port is
omitted, "0" is assumed; if the last is omitted, "65535" is
assumed. If the second port greater then the first they will be
swapped. The flag --sport is a convenient alias for this
option.
--destination-port [!] port[:port]
Destination port or port range specification. The flag --dport
is a convenient alias for this option.
--tcp-flags [!] mask comp
Match when the TCP flags are as specified. The first argument
is the flags which we should examine, written as a comma-sepa-
rated list, and the second argument is a comma-separated list of
flags which must be set. Flags are: SYN ACK FIN RST URG PSH ALL
NONE. Hence the command
iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST SYN
will only match packets with the SYN flag set, and the ACK, FIN
and RST flags unset.
[!] --syn
Only match TCP packets with the SYN bit set and the ACK and RST
bits cleared. Such packets are used to request TCP connection
initiation; for example, blocking such packets coming in an
interface will prevent incoming TCP connections, but outgoing
TCP connections will be unaffected. It is equivalent to --tcp-
flags SYN,RST,ACK SYN. If the "!" flag precedes the "--syn",
the sense of the option is inverted.
--tcp-option [!] number
Match if TCP option set.
--mss value[:value]
Match TCP SYN or SYN/ACK packets with the specified MSS value
(or range), which control the maximum packet size for that con-
nection.
tcpmss
This matches the TCP MSS (maximum segment size) field of the TCP
header. You can only use this on TCP SYN or SYN/ACK packets, since the
MSS is only negotiated during the TCP handshake at connection startup
time.
[!] --mss value[:value]"
Match a given TCP MSS value or range.
time
This matches if the packet arrival time/date is within a given range.
All options are facultative.
--timestart value
Match only if it is after ‘value’ (Inclusive, format: HH:MM ;
default 00:00).
--timestop value
Match only if it is before ‘value’ (Inclusive, format: HH:MM ;
default 23:59).
--days listofdays
Match only if today is one of the given days. (format:
Mon,Tue,Wed,Thu,Fri,Sat,Sun ; default everyday)
--datestart date
Match only if it is after ‘date’ (Inclusive, format:
YYYY[:MM[:DD[:hh[:mm[:ss]]]]] ; h,m,s start from 0 ; default to
1970)
--datestop date
Match only if it is before ‘date’ (Inclusive, format:
YYYY[:MM[:DD[:hh[:mm[:ss]]]]] ; h,m,s start from 0 ; default to
2037)
tos
This module matches the 8 bits of Type of Service field in the IP
header (ie. including the precedence bits).
--tos tos
The argument is either a standard name, (use
iptables -m tos -h
to see the list), or a numeric value to match.
ttl
This module matches the time to live field in the IP header.
--ttl-eq ttl
Matches the given TTL value.
--ttl-gt ttl
Matches if TTL is greater than the given TTL value.
--ttl-lt ttl
Matches if TTL is less than the given TTL value.
udp
These extensions are loaded if ‘--protocol udp’ is specified. It pro-
vides the following options:
--source-port [!] port[:port]
Source port or port range specification. See the description of
the --source-port option of the TCP extension for details.
--destination-port [!] port[:port]
Destination port or port range specification. See the descrip-
tion of the --destination-port option of the TCP extension for
details.
unclean
This module takes no options, but attempts to match packets which seem
malformed or unusual. This is regarded as experimental.
2012年3月22日 星期四
IPTABLES MATCH EXTENSIONS
訂閱：
張貼留言 (Atom)
How to repair and clone disk with ddrescue
ddrescue is a tool that can be used to repair and clone disks on a Linux system . This includes hard drives, partitions, DVD discs, flas...
-
From: http://blog.chinaaet.com/justlxy/p/5100064818 SMI：串行管理接口（Serial Management Interface），通常直接被稱為MDIO接口（Management Data Input/Output I...
-
from: https://www.wpgdadatong.com/tw/blog/detail?BID=B0594 一. PHY包含的各個子層 ： PCS：編碼和解碼 PMA：串行器和反序列化器 PMD：取決於物理介質 Firgure 1: OSI模型裡示意...
-
在 前面我們所談的那些可以說是比較基本的東西，但是對於一份文件來說，光有前面所介紹的游標移動、刪除等等功能是不足夠的。面對一份文件我們通常會因為某些 緣故而使得我們必須去修改當中固定出現的字串樣式(pattern)成我們想要的樣子。最常遇到的就像中文文件的標點符號問題，或是 un...
沒有留言:
張貼留言