iptables/ip6tables 手册简译

译文

名称

   iptables/ip6tables — 实现IPv4/IPv6包过滤以及网络地址转换（NAT）的管理员工具

摘要

   iptables [-t table] {-A|-C|-D} chain rule-specification

   ip6tables [-t table] {-A|-C|-D} chain rule-specification

   iptables [-t table] -I chain [rulenum] rule-specification

   iptables [-t table] -R chain rulenum rule-specification

   iptables [-t table] -D chain rulenum

   iptables [-t table] -S [chain [rulenum]]

   iptables [-t table] {-F|-L|-Z} [chain [rulenum]] [options...]

   iptables [-t table] -N chain

   iptables [-t table] -X [chain]

   iptables [-t table] -P chain target

   iptables [-t table] -E old-chain-name new-chain-name

   rule-specification = [matches...] [target]

   match = -m matchname [per-match-options]

   target = -j targetname [per-target-options]

描述

   Iptables和ip6tables是用来通过Linux kernel设置、维护、以及检测IPv4和IPv6数据包过滤规则表的工具。有多种规则表可以被定义，每一张表都包含了一系列内建的链或者用户自定义的链，每一个链都是由一列规则组成，并且匹配一组数据包，每一个规则明确指出了对应匹配的包进行什么操作，这种方式叫做目标选择，是同一张表中用户自定义链上的跳跃转移

目标

   一条防火墙规则指明了对于一个数据包或者目标所应用的规则，如果数据包不匹配，下一条规则将会继续进行匹配，如果数据包匹配了，那么下一条规则将会被选中目标的值所指明，这可能是一个用户自定义的链名称，一个在iptables-extensions(8)中被描述过的目标，或者是特定值ACCEPT、DROP、RETURN中的一个。ACCPET意味着允许数据包通过，DROP意味着将数据包丢弃，RETURN意味着停止这条链的贯穿，然后在当前链的下一条链中重新开始。如果内建链结束了或者说内建链内的一条带有目标RETURN的规则匹配了，这条链所指明的目标的策略决定了这个包的命运。

表
目前有五个各不相关的表(当前或者任意时间使用的表是由内核配置选项和当前运行模块决定的).

   -t, --table table
          此选项指出了匹配某个表的数据包将被执行什么样的操作，如果内核被配置为自动模块加载且不存在已加载模块，那么内核将会尝试为这张表加载适当的模块

          各表如下:

          filter:
              默认的表(如果没有指明-t选项)，此表包含了内建的链INPUT (对于到达本地套阶层的数据包), FORWARD (对于经过此路由的包), 和OUTPUT  (本地产生的数据包)

          nat:
              当一个创建了新的连接的包被遇到的时候，nat表将会被查找。nat表里包含三个内建链PREROUTING (只要包到达就对其进行改变), OUTPUT (在路由之前改变本地数据包), 和POSTROUTING (改变将要发出去的数据包).在kernel 3.7. IPv6 NAT已经被支持了。

          mangle:
              这张表是专门进行数据包更改的.直到kernel 2.4.17 mangle表包含两条内建链PREROUTING
              (在路由之前改变进来的数据包)和OUTPUT (在路由之前改变本地产生的数据包).自kernel 2.4.18起mangle也开始支持了其他的三张表INPUT (对于自己进到盒子里的数据包),  FORWARD (改变将要经过box进行路由的数据包), and POSTROUTING (改变将要出去的数据包).

          raw:
              这张表主要是为了配置免连接的追踪很无踪迹目标的结合。他用高优先级来注册网络筛选系统钩子，北称作before ip_conntrack或者其他ip表.raw表提供以下内建链PREROUTING (对于通过任何其他网络接口到达的数据包) OUTPUT (对于本地进程产生的数据包)

          security:
              这张表是用来进行强制访问控制（Mandatory Access Control (MAC)）的网络规则, 比如被SECMARK禁用和CONNSECMARK的目标.强制访问控制被linux的安全模块继承了，例如SELinux.安全表被称作后过滤表，它允许过滤表中任何自由访问控制规则（Discretionary Access Control ）DAC在MAC规则之前生效. security表提供了以下的内建链INPUT  (对于自动进入盒子的数据包), OUTPUT (在路由之前改变本地生成的数据包),和FORWARD(改变通过盒子进行路由的数据包).

选项参数

   由iptables和ip6tables表明的选项可以被分成几组。

命令
以下选项指明了将要被执行的操作. 以下选项只能单独在命令行中被指明使用，除非其他被指出的情况。

   -A, --append chain rule-specification
          在选定的链后添加一个或者多个规则

   -C, --check chain rule-specification
          检测一条规则是否匹配此链中指定的规则，或者说检测匹配规则是否存在C

   -D, --delete chain rule-specification
   -D, --delete chain rulenum
          删除一个或者多个从链中指定的规则，可以使用规则号码或者匹配的规则信息

   -I, --insert chain [rulenum] rule-specification
          向选定的链中以给定序号向对应位置插入一条或者多条规则。

   -R, --replace chain rulenum rule-specification
          替换选定链中的一条规则

   -L, --list [chain]
         列出链中的所有规则，如果没有指定链，则所有的链中的规则都将被显示
           用法：iptables -t nat -n -L
           用法：iptables -L -v

   -S, --list-rules [chain]
          显示所与选中链中的规则，如果未选中具体的链，则所有链的规则将以iptables-save形式打印出来

   -F, --flush [chain]
          刷新选中的链或者所有的链（如果未指定具体的链）。此操作等于删除了所有的规则

   -Z, --zero [chain [rulenum]]
          将所有链中的数据包归零,或者清零给定的链，或者指定链中的具体规则

   -N, --new-chain chain
          用给定的名称创建一条用户自定的链

   -X, --delete-chain [chain]
          删除用户自定的链. 要删除的链必须不存在其他参考.

   -P, --policy chain target
          对于给定的目标设置链的策略

   -E, --rename-chain old-chain new-chain
          用给定的链名称重命名一条旧的链

   -h     帮助.  给出(当前最简)语法描述.

参数陈列
以下参数明组成了一条规则的设置(例如添加、删除、插入、替换、附加等命令).

   -4, --ipv4
          此选项对iptables和iptables-restore无效.

   -6, --ipv6
          如果一条规则使用了-6参数插入iptables-restore此操作将会被默默忽略，其他的用法会报错

   [!] -p, --protocol protocol
          检测规则或者数据包的传输协议.

   [!] -s, --source address[/mask][,...]
          指明源，地址可以是网路名称,主机名,网络地址 (with /mask), 或者普通ip

   [!] -d, --destination address[/mask][,...]
          指明目的

   -m, --match match
          指明一条匹配的规则进行使用

   -j, --jump target
          指明规则的目标（下一跳）

   -g, --goto chain
          指明进程应该在用户指定的链中继续执行


   [!] -i, --in-interface name
          数据包要通过或者接收的接口名称(只有进入INPUT, FORWARD and PREROUTING
          链的数据包需要指明)

   [!] -o, --out-interface name
          指明数据包将要被送往的接口名称


   -c, --set-counters packets bytes
          此参数可以使管理员初始化数据包和字节计数(在 INSERT,  APPEND,  REPLACE操作中).

更多选项参数
以下为附加的参数选项以及用法讲解

   -v, --verbose
          显示操作的详细输出信息  

   -w, --wait [秒]
          等待xtables锁，阻止一个程序的多实例同时运行，并且一段时间试图去获得执行锁。默认的，如果不能获取执行锁，程序将会退出。此参数将会使进程等待，一直到获得执行锁

   -n, --numeric
          数字化输出，ip地址和端口号将会以数字格式显示出来。默认的，此程序会尝试列出主机名称或者网络名称或者服务名称

   -x, --exact
          数字详述.显示具体的数据包值以及字节数,而不是大约的K's(multiples of 1000) M's (multiples of 1000K)G's (multiples of 1000M)，此参数只与-L参数相关

   --line-numbers
          在列出规则时为每一行的开头天加一个行号,并且对应着规则在链中的位置

   --modprobe=command
         当向一个链中添加或者插入规则时，使用此命令去加载任意所需模块(目标,匹配扩展等).

匹配与目标拓展

   iptables可以使用扩展的数据包匹配和目标模块，可用列表可以查看iptables-extensions(8)

问题诊断

   各种错误将会显示到标准输出.退出码为0表示正确的执行.一般的错误原因是因为无效的或者命令参数的滥用，这些错误将会产生一个错误码2，其他的错误将会产生退出码1

ip链的兼容

   此iptable与Rusty Russell的ipchains非常相似.主要的区别在于链INPUT和OUTPUT是分别由本地生成的数据包和外部进入的数据包的贯穿。所以每一个数据包只通过以下三个链(除了回环阻塞，因为其既包含INPUT也包含OUTPUT链; 在此之前一个向前的数据包将通过所有三个链

   另一个差别在于 -i代表着输入接口; -o代表着输出接口, 两个参数都可以使数据包进入FORWARD链.

   不同形式的NAT已经被剔出;当使用默认的`filter'表时， iptables是一个带有扩展选项的完全的包过滤模块.这将明了先前的许多关于ip伪装和包过滤的疑虑，所以下列选项的处理完全不同
    -j MASQ
    -M -S
    -M -L
  对于iptables还有其他一些不同点，可自寻.

拓展阅读

   iptables-apply(8), iptables-save(8), iptables-restore(8), iptables-extensions(8),

   如何过滤数据包详细讲述了iptables对于数据包过滤的用法,如何进行NAT详述了NAT,如何进行网络过滤详述了没有在标准中指出的关于此部分内容的扩展网络过滤奇技详述了网络过滤的内部实现，详细文档请浏览http://www.netfilter.org/.

原文：

IPTABLES(8) iptables 1.4.21 IPTABLES(8)

NAME
iptables/ip6tables — administration tool for IPv4/IPv6 packet filtering and NAT

SYNOPSIS

   iptables [-t table] {-A|-C|-D} chain rule-specification

   ip6tables [-t table] {-A|-C|-D} chain rule-specification

   iptables [-t table] -I chain [rulenum] rule-specification

   iptables [-t table] -R chain rulenum rule-specification

   iptables [-t table] -D chain rulenum

   iptables [-t table] -S [chain [rulenum]]

   iptables [-t table] {-F|-L|-Z} [chain [rulenum]] [options...]

   iptables [-t table] -N chain

   iptables [-t table] -X [chain]

   iptables [-t table] -P chain target

   iptables [-t table] -E old-chain-name new-chain-name

   rule-specification = [matches...] [target]

   match = -m matchname [per-match-options]

   target = -j targetname [per-target-options]

DESCRIPTION
Iptables and ip6tables are used to set up, maintain, and inspect the tables of IPv4 and IPv6 packet filter rules in the
Linux kernel. Several different tables may be defined. Each table contains a number of built-in chains and may also con‐
tain user-defined chains.

   Each  chain is a list of rules which can match a set of packets.  Each rule specifies what to do with a packet that matches.
   This is called a `target', which may be a jump to a user-defined chain in the same table.

TARGETS
A firewall rule specifies criteria for a packet and a target. If the packet does not match, the next rule in the chain is
examined; if it does match, then the next rule is specified by the value of the target, which can be the name of a user-
defined chain, one of the targets described in iptables-extensions(8), or one of the special values ACCEPT, DROP or RETURN.

   ACCEPT means to let the packet through.  DROP means to drop the packet on the floor.   RETURN  means  stop  traversing  this
   chain and resume at the next rule in the previous (calling) chain.  If the end of a built-in chain is reached or a rule in a
   built-in chain with target RETURN is matched, the target specified by the chain policy determines the fate of the packet.

TABLES
There are currently five independent tables (which tables are present at any time depends on the kernel configuration
options and which modules are present).

   -t, --table table
          This  option  specifies  the  packet matching table which the command should operate on.  If the kernel is configured
          with automatic module loading, an attempt will be made to load the appropriate module for that table  if  it  is  not
          already there.

          The tables are as follows:

          filter:
              This  is  the  default table (if no -t option is passed). It contains the built-in chains INPUT (for packets des‐
              tined to local sockets), FORWARD (for packets being routed through the box), and  OUTPUT  (for  locally-generated
              packets).

          nat:
              This  table is consulted when a packet that creates a new connection is encountered.  It consists of three built-
              ins: PREROUTING (for altering packets as soon as they come in), OUTPUT (for  altering  locally-generated  packets
              before  routing), and POSTROUTING (for altering packets as they are about to go out).  IPv6 NAT support is avail‐
              able since kernel 3.7.

          mangle:
              This table is used for specialized packet alteration.  Until kernel 2.4.17 it had two built-in chains: PREROUTING
              (for  altering  incoming  packets before routing) and OUTPUT (for altering locally-generated packets before rout‐
              ing).  Since kernel 2.4.18, three other built-in chains are also supported: INPUT (for packets  coming  into  the
              box  itself),  FORWARD (for altering packets being routed through the box), and POSTROUTING (for altering packets
              as they are about to go out).

          raw:
              This table is used mainly for configuring exemptions from connection tracking in  combination  with  the  NOTRACK
              target.   It registers at the netfilter hooks with higher priority and is thus called before ip_conntrack, or any
              other IP tables.  It provides the following built-in chains: PREROUTING (for packets  arriving  via  any  network
              interface) OUTPUT (for packets generated by local processes)

          security:
              This  table is used for Mandatory Access Control (MAC) networking rules, such as those enabled by the SECMARK and
              CONNSECMARK targets.  Mandatory Access Control is implemented by Linux Security Modules  such  as  SELinux.   The
              security  table  is  called  after the filter table, allowing any Discretionary Access Control (DAC) rules in the
              filter table to take effect before MAC rules.  This table provides the  following  built-in  chains:  INPUT  (for
              packets  coming into the box itself), OUTPUT (for altering locally-generated packets before routing), and FORWARD
              (for altering packets being routed through the box).

OPTIONS
The options that are recognized by iptables and ip6tables can be divided into several different groups.

COMMANDS
These options specify the desired action to perform. Only one of them can be specified on the command line unless otherwise
stated below. For long versions of the command and option names, you need to use only enough letters to ensure that iptables
can differentiate it from all other options.

   -A, --append chain rule-specification
          Append one or more rules to the end of the selected chain.  When the source and/or destination names resolve to  more
          than one address, a rule will be added for each possible address combination.

   -C, --check chain rule-specification
          Check whether a rule matching the specification does exist in the selected chain. This command uses the same logic as
          -D to find a matching entry, but does not alter the existing iptables configuration and uses its exit code  to  indi‐
          cate success or failure.

   -D, --delete chain rule-specification
   -D, --delete chain rulenum
          Delete  one or more rules from the selected chain.  There are two versions of this command: the rule can be specified
          as a number in the chain (starting at 1 for the first rule) or a rule to match.

   -I, --insert chain [rulenum] rule-specification
          Insert one or more rules in the selected chain as the given rule number.  So, if the rule number is 1,  the  rule  or
          rules are inserted at the head of the chain.  This is also the default if no rule number is specified.

   -R, --replace chain rulenum rule-specification
          Replace a rule in the selected chain.  If the source and/or destination names resolve to multiple addresses, the com‐
          mand will fail.  Rules are numbered starting at 1.

   -L, --list [chain]
          List all rules in the selected chain.  If no chain is selected, all chains are listed. Like every other iptables com‐
          mand, it applies to the specified table (filter is the default), so NAT rules get listed by
           iptables -t nat -n -L
          Please  note  that  it  is often used with the -n option, in order to avoid long reverse DNS lookups.  It is legal to
          specify the -Z (zero) option as well, in which case the chain(s) will be atomically listed  and  zeroed.   The  exact
          output is affected by the other arguments given. The exact rules are suppressed until you use
           iptables -L -v

   -S, --list-rules [chain]
          Print  all  rules  in  the  selected chain.  If no chain is selected, all chains are printed like iptables-save. Like
          every other iptables command, it applies to the specified table (filter is the default).

   -F, --flush [chain]
          Flush the selected chain (all the chains in the table if none is given).  This is  equivalent  to  deleting  all  the
          rules one by one.

   -Z, --zero [chain [rulenum]]
          Zero  the  packet  and byte counters in all chains, or only the given chain, or only the given rule in a chain. It is
          legal to specify the -L, --list (list) option as well, to see the counters immediately before they are cleared.  (See
          above.)

   -N, --new-chain chain
          Create a new user-defined chain by the given name.  There must be no target of that name already.

   -X, --delete-chain [chain]
          Delete  the optional user-defined chain specified.  There must be no references to the chain.  If there are, you must
          delete or replace the referring rules before the chain can be deleted.  The chain must be empty, i.e. not contain any
          rules.  If no argument is given, it will attempt to delete every non-builtin chain in the table.

   -P, --policy chain target
          Set  the  policy  for  the  chain to the given target.  See the section TARGETS for the legal targets.  Only built-in
          (non-user-defined) chains can have policies, and neither built-in nor user-defined chains can be policy targets.

   -E, --rename-chain old-chain new-chain
          Rename the user specified chain to the user supplied name.  This is cosmetic, and has no effect on the  structure  of
          the table.

   -h     Help.  Give a (currently very brief) description of the command syntax.

PARAMETERS
The following parameters make up a rule specification (as used in the add, delete, insert, replace and append commands).

   -4, --ipv4
          This option has no effect in iptables and iptables-restore.  If a rule using the -4 option is inserted with (and only
          with) ip6tables-restore, it will be silently ignored. Any other uses will throw an error. This option allows  to  put
          both IPv4 and IPv6 rules in a single rule file for use with both iptables-restore and ip6tables-restore.

   -6, --ipv6
          If  a  rule  using  the -6 option is inserted with (and only with) iptables-restore, it will be silently ignored. Any
          other uses will throw an error. This option allows to put both IPv4 and IPv6 rules in a single rule file for use with
          both iptables-restore and ip6tables-restore.  This option has no effect in ip6tables and ip6tables-restore.

   [!] -p, --protocol protocol
          The  protocol  of  the rule or of the packet to check.  The specified protocol can be one of tcp, udp, udplite, icmp,
          icmpv6,esp, ah, sctp, mh or the special keyword "all", or it can be a numeric value, representing one of these proto‐
          cols  or  a  different one.  A protocol name from /etc/protocols is also allowed.  A "!" argument before the protocol
          inverts the test.  The number zero is equivalent to all. "all" will match with all protocols and is taken as  default
          when  this  option  is omitted.  Note that, in ip6tables, IPv6 extension headers except esp are not allowed.  esp and
          ipv6-nonext can be used with Kernel version 2.6.11 or later.  The number zero is equivalent to all, which means  that
          you  cannot test the protocol field for the value 0 directly. To match on a HBH header, even if it were the last, you
          cannot use -p 0, but always need -m hbh.

   [!] -s, --source address[/mask][,...]
          Source specification. Address can be either a network name, a hostname, a network IP address (with /mask), or a plain
          IP address. Hostnames will be resolved once only, before the rule is submitted to the kernel.  Please note that spec‐
          ifying any name to be resolved with a remote query such as DNS is a really bad idea.  The mask can be either an  ipv4
          network  mask  (for  iptables)  or a plain number, specifying the number of 1's at the left side of the network mask.
          Thus, an iptables mask of 24 is equivalent to 255.255.255.0.  A "!" argument before the address specification inverts
          the  sense of the address. The flag --src is an alias for this option.  Multiple addresses can be specified, but this
          will expand to multiple rules (when adding with -A), or will cause multiple rules to be deleted (with -D).

   [!] -d, --destination address[/mask][,...]
          Destination specification.  See the description of the -s (source) flag for a detailed  description  of  the  syntax.
          The flag --dst is an alias for this option.

   -m, --match match
          Specifies a match to use, that is, an extension module that tests for a specific property. The set of matches make up
          the condition under which a target is invoked. Matches are evaluated first to last as specified on the  command  line
          and work in short-circuit fashion, i.e. if one extension yields false, evaluation will stop.

   -j, --jump target
          This  specifies  the target of the rule; i.e., what to do if the packet matches it.  The target can be a user-defined
          chain (other than the one this rule is in), one of the special builtin targets which decide the fate  of  the  packet
          immediately,  or an extension (see EXTENSIONS below).  If this option is omitted in a rule (and -g is not used), then
          matching the rule will have no effect on the packet's fate, but the counters on the rule will be incremented.

   -g, --goto chain
          This specifies that the processing should continue in a user specified chain. Unlike the --jump  option  return  will
          not continue processing in this chain but instead in the chain that called us via --jump.

   [!] -i, --in-interface name
          Name  of  an  interface  via which a packet was received (only for packets entering the INPUT, FORWARD and PREROUTING
          chains).  When the "!" argument is used before the interface name, the sense is inverted.  If the interface name ends
          in  a  "+", then any interface which begins with this name will match.  If this option is omitted, any interface name
          will match.

   [!] -o, --out-interface name
          Name of an interface via which a packet is going to be sent (for packets entering the FORWARD, OUTPUT and POSTROUTING
          chains).  When the "!" argument is used before the interface name, the sense is inverted.  If the interface name ends
          in a "+", then any interface which begins with this name will match.  If this option is omitted, any  interface  name
          will match.

   [!] -f, --fragment
          This  means  that the rule only refers to second and further IPv4 fragments of fragmented packets.  Since there is no
          way to tell the source or destination ports of such a packet (or ICMP type), such a packet will not match  any  rules
          which  specify  them.   When  the  "!"  argument  precedes the "-f" flag, the rule will only match head fragments, or
          unfragmented packets. This option is IPv4 specific, it is not available in ip6tables.

   -c, --set-counters packets bytes
          This enables the administrator to initialize the packet and byte counters of a rule (during INSERT,  APPEND,  REPLACE
          operations).

OTHER OPTIONS
The following additional options can be specified:

   -v, --verbose
          Verbose  output.   This option makes the list command show the interface name, the rule options (if any), and the TOS
          masks.  The packet and byte counters are also listed, with the suffix  'K',  'M'  or  'G'  for  1000,  1,000,000  and
          1,000,000,000  multipliers respectively (but see the -x flag to change this).  For appending, insertion, deletion and
          replacement, this causes detailed information on the rule or rules to be printed. -v may be specified multiple  times
          to possibly emit more detailed debug statements.

   -w, --wait [seconds]
          Wait  for  the xtables lock.  To prevent multiple instances of the program from running concurrently, an attempt will
          be made to obtain an exclusive lock at launch.  By default, the program will exit if the  lock  cannot  be  obtained.
          This  option  will  make  the  program  wait  (indefinitely  or for optional seconds) until the exclusive lock can be
          obtained.

   -n, --numeric
          Numeric output.  IP addresses and port numbers will be printed in numeric format.  By default, the program  will  try
          to display them as host names, network names, or services (whenever applicable).

   -x, --exact
          Expand  numbers.   Display the exact value of the packet and byte counters, instead of only the rounded number in K's
          (multiples of 1000) M's (multiples of 1000K) or G's (multiples of 1000M).  This option is only relevant  for  the  -L
          command.

   --line-numbers
          When  listing  rules,  add  line  numbers to the beginning of each rule, corresponding to that rule's position in the
          chain.

   --modprobe=command
          When adding or inserting rules into a chain, use command to load any necessary modules  (targets,  match  extensions,
          etc).

MATCH AND TARGET EXTENSIONS
iptables can use extended packet matching and target modules. A list of these is available in the iptables-extensions(8)
manpage.

DIAGNOSTICS
Various error messages are printed to standard error. The exit code is 0 for correct functioning. Errors which appear to
be caused by invalid or abused command line parameters cause an exit code of 2, and other errors cause an exit code of 1.

BUGS
Bugs? What’s this? ;-) Well, you might want to have a look at http://bugzilla.netfilter.org/

COMPATIBILITY WITH IPCHAINS
This iptables is very similar to ipchains by Rusty Russell. The main difference is that the chains INPUT and OUTPUT are
only traversed for packets coming into the local host and originating from the local host respectively. Hence every packet
only passes through one of the three chains (except loopback traffic, which involves both INPUT and OUTPUT chains); previ‐
ously a forwarded packet would pass through all three.

   The other main difference is that -i refers to the input interface; -o refers to the output interface, and both  are  avail‐
   able for packets entering the FORWARD chain.

   The  various  forms  of NAT have been separated out; iptables is a pure packet filter when using the default `filter' table,
   with optional extension modules.  This should simplify much of the previous confusion over the combination of IP  masquerad‐
   ing and packet filtering seen previously.  So the following options are handled differently:
    -j MASQ
    -M -S
    -M -L
   There are several other changes in iptables.

SEE ALSO
iptables-apply(8), iptables-save(8), iptables-restore(8), iptables-extensions(8),

   The packet-filtering-HOWTO details iptables usage for packet filtering, the NAT-HOWTO details NAT, the netfilter-extensions-
   HOWTO details the extensions that are not in the standard distribution, and the netfilter-hacking-HOWTO details the  netfil‐
   ter internals.
   See http://www.netfilter.org/.

AUTHORS
Rusty Russell originally wrote iptables, in early consultation with Michael Neuling.

   Marc  Boucher  made  Rusty abandon ipnatctl by lobbying for a generic packet selection framework in iptables, then wrote the
   mangle table, the owner match, the mark stuff, and ran around doing cool stuff everywhere.

   James Morris wrote the TOS target, and tos match.

   Jozsef Kadlecsik wrote the REJECT target.

   Harald Welte wrote the ULOG and NFQUEUE target, the new libiptc, as well as the TTL, DSCP, ECN matches and targets.

   The Netfilter Core Team is: Marc Boucher, Martin Josefsson, Yasuyuki Kozakai, Jozsef Kadlecsik, Patrick McHardy, James  Mor‐
   ris, Pablo Neira Ayuso, Harald Welte and Rusty Russell.

   Man page originally written by Herve Eychenne .

VERSION
This manual page applies to iptables/ip6tables @PACKAGE_AND_VERSION@.

iptables 1.4.21 IPTABLES(8)