Red Hat LINUX 7.2 Reference Manual page 304

304
• --tcp-option Attempts to match with TCP-specific options that can be set within a particular
packet. This match option can also be reversed with the exclamation point character (!).
UDP Protocol
These match options are available for the UDP protocol (-p udp):
• --dport Specifies the destination port of the UDP packet, using the service name, port number,
or range of port numbers. The --destination-port match option may be used instead of
--dport. See the --dport match option in TCP Protocol in Section 18.3.5 for various ways
to use this option.
• --sport Specifies the source port of the UDP packet, using the service name, port number, or
range of port numbers. The --source-port match option may be used instead of --sport.
See the --dport match option in TCP Protocol in Section 18.3.5 for various ways to use this
option.
ICMP Protocol
Packets using the Internet Control Message Protocol (ICMP) can be matched using the following op-
tion when -p icmp is specified:
• --icmp-type Sets the name or number of the ICMP type to match with the rule. A list of valid
ICMP names can be seen by typing the iptables -p icmp -h command.
Modules with Additional Match Options
Additional match options, which are not specific to a particular protocol, are also available through
modules which load when the iptables command utilizes them. To utilize a match option module,
you must load the module by name by including -m <module-name> in the iptables command
creating a rule.
A large number of modules, each with their own specific match options, are available by default. It
is even possible to create your own modules to provide additional match option functionality, perhaps
for specific network requirements. Many modules exist, but only the most popular ones are discussed
here.
The limit module allows you to place a limit on how many packets will be matched to a particular
rule. This is especially beneficial when logging rule matches so that a flood of matching packets will
not fill up your logs with repetitive messages or use too many system resources.
• --limit — Sets the number of matches for a particular range of time, specified with a number
and time modifier arranged in a <number>/<time> format. For example, using --limit
5/hour only lets a rule match five times in a single hour.
If a number and time modifier are not used, the default value of 3/hour is assumed.
Chapter 18:Firewalling with iptables