Red Hat ENTERPRISE LINUX 3 Reference Manual page 276

258
and aliases of network services and the port numbers they use, view the
--destination-port
To specify a specific range of port numbers, separate the two numbers with a colon (
tcp --dport 3000:3200
Use an exclamation point character (
use that network service or port.
— Sets the source port of the packet using the same options as
• --sport
--source-port
— Applies to all TCP packets designed to initiate communication, commonly called SYN
• --syn
packets. Any packets that carry a data payload are not touched. Placing an exclamation point char-
acter ( ) as a flag after the
!
— Allows TCP packets with specific bits, or flags, set to be matched with a rule.
• --tcp-flags
The
--tcp-flags
sets the flags to be examined in the packet. The second parameter refers to the flag that must be set
to match.
The possible flags are:
ACK
•
FIN
•
PSH
•
RST
•
SYN
•
URG
•
ALL
•
NONE
•
For example, an
iptables
matches TCP packets that have the SYN flag set and the ACK and FIN flags unset.
Using the exclamation point character (
option.
— Attempts to match with TCP-specific options that can be set within a particular
•
--tcp-option
packet. This match option can also be reversed with the exclamation point character (
17.3.4.2. UDP Protocol
These match options are available for the UDP protocol (
— Specifies the destination port of the UDP packet, using the service name, port number,
• --dport
or range of port numbers. The
Refer to the
--dport
— Specifies the source port of the UDP packet, using the service name, port number, or
• --sport
range of port numbers. The
the match option in Section 17.3.4.1 TCP Protocol for ways to use this option.
--sport
match option is synonymous with
. The largest acceptable valid range is
) after the
!
match option is synonymous with
option causes all non-SYN packets to be matched.
--syn
match option accepts two parameters. The first parameter is the mask, which
rule which contains
--destination-port
match option in Section 17.3.4.1 TCP Protocol for ways to use this option.
--source-port
--dport
option to match all packets which do not
--dport
--sport
-p tcp --tcp-flags ACK,FIN,SYN SYN
) after
! --tcp-flags
-p udp
match option is synonymous with
match option is synonymous with
Chapter 17.
/etc/services
.
.
0:65535
.
reverses the effect of the match
):
--sport
iptables
file. The
), such as
: -p
. The
--dport
only
).
!
.
--dport
. Refer to