*nix Documentation Project
·  Home
 +   man pages
·  Linux HOWTOs
·  FreeBSD Tips
·  *niX Forums

  man pages->Linux man pages -> ip6tables (8)              
Title
Content
Arch
Section
 

IP6TABLES(8)

Contents


NAME    [Toc]    [Back]

       ip6tables - IPv6 packet filter administration

SYNOPSIS    [Toc]    [Back]

       ip6tables -[ADC] chain rule-specification [options]
       ip6tables -I chain [rulenum] rule-specification [options]
       ip6tables -R chain rulenum rule-specification [options]
       ip6tables -D chain rulenum [options]
       ip6tables -[LFZ] [chain] [options]
       ip6tables -N chain
       ip6tables -X [chain]
       ip6tables -P chain target [options]
       ip6tables -E old-chain-name new-chain-name

DESCRIPTION    [Toc]    [Back]

       Ip6tables  is  used to set up, maintain, and inspect the tables of IPv6
       packet filter rules in the Linux kernel.  Several different tables  may
       be  defined.   Each  table contains a number of built-in chains and may
       also contain user-defined chains.

       Each chain is a list of rules which can match a set of  packets.   Each
       rule specifies what to do with a packet that matches.  This is called a
       `target', which may be a jump to a user-defined chain in the  same  table.


TARGETS    [Toc]    [Back]

       A  firewall rule specifies criteria for a packet, and a target.	If the
       packet does not match, the next rule in the chain is the  examined;  if
       it does match, then the next rule is specified by the value of the target,
 which can be the name of a user-defined chain or one of  the  special
 values ACCEPT, DROP, QUEUE, or RETURN.

       ACCEPT  means to let the packet through.  DROP means to drop the packet
       on the floor.  QUEUE means to pass the packet  to  userspace  (if  supported
  by  the	kernel).   RETURN means stop traversing this chain and
       resume at the next rule in the previous (calling) chain.  If the end of
       a  built-in  chain is reached or a rule in a built-in chain with target
       RETURN is matched, the target specified by the chain policy  determines
       the fate of the packet.

TABLES    [Toc]    [Back]

       There are current three independent tables (which tables are present at
       any time depends on the kernel configuration options and which  modules
       are present).

       -t, --table table
	      This  option  specifies the packet matching table which the command
 should operate on.  If the kernel is configured with  automatic
 module loading, an attempt will be made to load the appropriate
 module for that table if it is not already there.

	      The tables are as follows:

       filter This is the default table.   It  contains  the  built-in	chains
	      INPUT  (for  packets  coming  into the box itself), FORWARD (for
	      packets being routed through the box), and OUTPUT (for  locallygenerated
 packets).

       mangle This  table  is  used  for specialized packet alteration.  Until
	      kernel 2.4.17 it had two built-in chains: PREROUTING (for altering
  incoming  packets  before routing) and OUTPUT (for altering
	      locally-generated packets before routing).  Since kernel 2.4.18,
	      three  other  built-in  chains  are  also supported : INPUT (for
	      packets coming into the box itself), FORWARD (for altering packets
 being routed through the box), and POSTROUTING (for altering
	      packets as they are about to go out).

OPTIONS    [Toc]    [Back]

       The options that are recognized by ip6tables can be divided  into  several
 different groups.

   COMMANDS    [Toc]    [Back]
       These options specify the specific action to perform.  Only one of them
       can be specified on the command line unless otherwise specified	below.
       For  all the long versions of the command and option names, you need to
       use only enough letters to ensure that ip6tables can  differentiate  it
       from all other options.

       -A, --append chain rule-specification
	      Append one or more rules to the end of the selected chain.  When
	      the source and/or destination names resolve  to  more  than  one
	      address, a rule will be added for each possible address combination.


       -D, --delete chain rule-specification
       -D, --delete chain rulenum
	      Delete one or more rules from the selected chain.  There are two
	      versions	of this command: the rule can be specified as a number
	      in the chain (starting at 1 for the first rule)  or  a  rule  to
	      match.

       -I, --insert
	      Insert one or more rules in the selected chain as the given rule
	      number.  So, if the rule number is 1,  the  rule	or  rules  are
	      inserted	at the head of the chain.  This is also the default if
	      no rule number is specified.

       -R, --replace chain rulenum rule-specification
	      Replace a rule in the selected chain.  If the source and/or destination
	names  resolve to multiple addresses, the command will
	      fail.  Rules are numbered starting at 1.

       -L, --list [chain]
	      List all rules in the selected chain.  If no chain is  selected,
	      all  chains  are	listed.   As  every other iptables command, it
	      applies to the specified table (filter is the default),  so  NAT
	      rules get listed by
	       iptables -t nat -n -L
	      Please  note  that it is often used with the -n option, in order
	      to avoid long reverse DNS lookups.  It is legal to  specify  the
	      -Z  (zero)  option  as  well, in which case the chain(s) will be
	      atomically listed and zeroed.  The exact output is  affected  by
	      the other arguments given.

       -F, --flush [chain]
	      Flush the selected chain (all the chains in the table if none is
	      given).  This is equivalent to deleting all  the	rules  one  by
	      one.

       -Z, --zero [chain]
	      Zero the packet and byte counters in all chains.	It is legal to
	      specify the -L, --list (list) option as well, to see  the  counters
 immediately before they are cleared. (See above.)

       -N, --new-chain chain
	      Create  a  new user-defined chain by the given name.  There must
	      be no target of that name already.

       -X, --delete-chain [chain]
	      Delete the optional user-defined chain specified.  There must be
	      no  references  to  the chain.  If there are, you must delete or
	      replace the referring rules before the chain can be deleted.  If
	      no  argument  is	given,	it  will  attempt to delete every nonbuiltin
 chain in the table.

       -P, --policy chain target
	      Set the policy for the chain to the given target.  See the  section
  TARGETS  for  the legal targets.  Only built-in (non-userdefined)
 chains can have	policies,  and	neither  built-in  nor
	      user-defined chains can be policy targets.

       -E, --rename-chain  old-chain new-chain
	      Rename the user specified chain to the user supplied name.  This
	      is cosmetic, and has no effect on the structure of the table.

       -h     Help.  Give a (currently very brief) description of the  command
	      syntax.

   PARAMETERS    [Toc]    [Back]
       The  following  parameters make up a rule specification (as used in the
       add, delete, insert, replace and append commands).

       -p, --protocol [!] protocol
	      The protocol of the rule or of the packet to check.  The	specified
  protocol can be one of tcp, udp, ipv6-icmp|icmpv6, or all,
	      or it can be a numeric value, representing one of  these	protocols
 or a different one.	A protocol name from /etc/protocols is
	      also allowed.  A "!" argument before the	protocol  inverts  the
	      test.   The number zero is equivalent to all.  Protocol all will
	      match with all protocols and  is	taken  as  default  when  this
	      option is omitted.

       -s, --source [!] address[/mask]
	      Source  specification.  Address can be either a hostname (please
	      note that specifying any name to be resolved with a remote query
	      such  as DNS is a really bad idea), or a plain IPv6 address (the
	      network name isn't supported now).  The mask  can  be  either  a
	      network  mask or a plain number, specifying the number of 1's at
	      the left side of the network mask.  Thus, a mask of 64 is equivalent
  to  ffff:ffff:ffff:ffff:0000:0000:0000:0000.  A "!" argument
 before the address specification inverts the sense  of  the
	      address. The flag --src is an alias for this option.

       -d, --destination [!] address[/mask]
	      Destination  specification.   See  the  description  of  the  -s
	      (source) flag for a detailed description	of  the  syntax.   The
	      flag --dst is an alias for this option.

       -j, --jump target
	      This  specifies  the target of the rule; i.e., what to do if the
	      packet matches it.  The  target  can  be	a  user-defined  chain
	      (other than the one this rule is in), one of the special builtin
	      targets which decide the fate of the packet immediately,	or  an
	      extension  (see EXTENSIONS below).  If this option is omitted in
	      a rule, then matching the  rule  will  have  no  effect  on  the
	      packet's fate, but the counters on the rule will be incremented.

       -i, --in-interface [!] name
	      Name of an interface via which a packet is going to be  received
	      (only  for  packets  entering  the INPUT, FORWARD and PREROUTING
	      chains).	When the "!" argument is  used	before	the  interface
	      name,  the  sense  is inverted.  If the interface name ends in a
	      "+", then any interface which begins with this name will	match.
	      If this option is omitted, any interface name will match.

       -o, --out-interface [!] name
	      Name of an interface via which a packet is going to be sent (for
	      packets entering the FORWARD and OUTPUT chains).	When  the  "!"
	      argument	is  used  before  the  interface  name,  the  sense is
	      inverted.  If the interface name ends in a "+", then any	interface
  which begins with this name will match.  If this option is
	      omitted, any interface name will match.

       -c, --set-counters  PKTS BYTES
	      This enables the administrater to initialize the packet and byte
	      counters	of a rule (during INSERT, APPEND, REPLACE operations).

   OTHER OPTIONS    [Toc]    [Back]
       The following additional options can be specified:

       -v, --verbose
	      Verbose output.  This option makes the  list  command  show  the
	      interface address, the rule options (if any), and the TOS masks.
	      The packet and byte counters are also listed,  with  the	suffix
	      'K',  'M' or 'G' for 1000, 1,000,000 and 1,000,000,000 multipliers
 respectively (but see the -x	flag  to  change  this).   For
	      appending,  insertion,  deletion	and  replacement,  this causes
	      detailed information on the rule or rules to be printed.

       -n, --numeric
	      Numeric output.  IP addresses and port numbers will  be  printed
	      in  numeric format.  By default, the program will try to display
	      them as host names, network names, or services (whenever	applicable).


       -x, --exact
	      Expand  numbers.	Display the exact value of the packet and byte
	      counters, instead of only the rounded number in  K's  (multiples
	      of  1000)  M's (multiples of 1000K) or G's (multiples of 1000M).
	      This option is only relevant for the -L command.

       --line-numbers
	      When listing rules, add line numbers to the  beginning  of  each
	      rule, corresponding to that rule's position in the chain.

       --modprobe=command
	      When adding or inserting rules into a chain, use command to load
	      any necessary modules (targets, match extensions, etc).

MATCH EXTENSIONS    [Toc]    [Back]

       ip6tables can use extended packet matching modules.  These  are	loaded
       in  two	ways:  implicitly, when -p or --protocol is specified, or with
       the -m or --match options, followed by the matching module name;  after
       these,  various	extra command line options become available, depending
       on the specific module.	You can specify multiple extended  match  modules
  in  one  line, and you can use the -h or --help options after the
       module has been specified to receive help specific to that module.

       The following are included in the base package, and most of  these  can
       be preceded by a !  to invert the sense of the match.

   tcp
       These  extensions  are loaded if `--protocol tcp' is specified. It provides
 the following options:

       --source-port [!] port[:port]
	      Source port or port range specification. This can  either  be  a
	      service  name  or  a port number. An inclusive range can also be
	      specified, using the format port:port.  If  the  first  port  is
	      omitted,	"0"  is  assumed;  if  the last is omitted, "65535" is
	      assumed.	If the second port greater then the first they will be
	      swapped.	 The  flag  --sport  is  a  convenient	alias for this
	      option.

       --destination-port [!] port[:port]
	      Destination port or port range specification.  The flag  --dport
	      is a convenient alias for this option.

       --tcp-flags [!] mask comp
	      Match  when  the TCP flags are as specified.  The first argument
	      is the flags which we should examine, written as	a  comma-separated
 list, and the second argument is a comma-separated list of
	      flags which must be set.	Flags are: SYN ACK FIN RST URG PSH ALL
	      NONE.  Hence the command
	       ip6tables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST SYN
	      will  only match packets with the SYN flag set, and the ACK, FIN
	      and RST flags unset.

       [!] --syn
	      Only match TCP packets with the SYN bit set and the ACK and  FIN
	      bits  cleared.   Such packets are used to request TCP connection
	      initiation; for example, blocking  such  packets	coming	in  an
	      interface  will  prevent	incoming TCP connections, but outgoing
	      TCP connections will be unaffected.  It is equivalent to	--tcp-
	      flags  SYN,RST,ACK  SYN.	 If the "!" flag precedes the "--syn",
	      the sense of the option is inverted.

       --tcp-option [!] number
	      Match if TCP option set.

   udp
       These extensions are loaded if `--protocol udp' is specified.  It  provides
 the following options:

       --source-port [!] port[:port]
	      Source port or port range specification.	See the description of
	      the --source-port option of the TCP extension for details.

       --destination-port [!] port[:port]
	      Destination port or port range specification.  See the  description
  of	the --destination-port option of the TCP extension for
	      details.

   ipv6-icmp
       This extension is  loaded  if  `--protocol  ipv6-icmp'  or  `--protocol
       icmpv6' is specified. It provides the following option:

       --icmpv6-type [!] typename
	      This  allows  specification  of  the  ICMP  type, which can be a
	      numeric IPv6-ICMP type, or one of the IPv6-ICMP type names shown
	      by the command
	       ip6tables -p ipv6-icmp -h

   mac
       --mac-source [!] address
	      Match   source   MAC   address.	 It   must   be  of  the  form
	      XX:XX:XX:XX:XX:XX.  Note that this only makes sense for  packets
	      coming from an Ethernet device and entering the PREROUTING, FOR-
	      WARD or INPUT chains.

   limit
       This module matches at a limited rate using a token bucket  filter.   A
       rule  using  this  extension  will  match  until  this limit is reached
       (unless the `!' flag is used).  It can be used in combination with  the
       LOG target to give limited logging, for example.

       --limit rate
	      Maximum  average	matching  rate: specified as a number, with an
	      optional `/second', `/minute', `/hour', or  `/day'  suffix;  the
	      default is 3/hour.

       --limit-burst number
	      Maximum  initial	number	of  packets to match: this number gets
	      recharged by one every time the limit  specified	above  is  not
	      reached, up to this number; the default is 5.

   multiport
       This  module  matches  a  set of source or destination ports.  Up to 15
       ports can be specified.	It can only be used in conjunction with -p tcp
       or -p udp.

       --source-ports port[,port[,port...]]
	      Match  if  the  source port is one of the given ports.  The flag
	      --sports is a convenient alias for this option.

       --destination-ports port[,port[,port...]]
	      Match if the destination port is one of the  given  ports.   The
	      flag --dports is a convenient alias for this option.

       --ports port[,port[,port...]]
	      Match  if the both the source and destination ports are equal to
	      each other and to one of the given ports.

   mark
       This module matches the netfilter mark field associated with  a	packet
       (which can be set using the MARK target below).

       --mark value[/mask]
	      Matches packets with the given unsigned mark value (if a mask is
	      specified, this is logically ANDed with the mask before the comparison).


   owner
       This  module  attempts  to  match various characteristics of the packet
       creator, for locally-generated packets.	It is only valid in the OUTPUT
       chain,  and  even  this	some packets (such as ICMP ping responses) may
       have no owner, and hence never match.  This is regarded	as  experimental.


       --uid-owner userid
	      Matches  if  the	packet was created by a process with the given
	      effective user id.

       --gid-owner groupid
	      Matches if the packet was created by a process  with  the  given
	      effective group id.

       --pid-owner processid
	      Matches  if  the	packet was created by a process with the given
	      process id.

       --sid-owner sessionid
	      Matches if the packet was created by a process in the given session
 group.

TARGET EXTENSIONS    [Toc]    [Back]

       ip6tables  can  use extended target modules: the following are included
       in the standard distribution.

   LOG    [Toc]    [Back]
       Turn on kernel logging of matching packets.  When this  option  is  set
       for  a rule, the Linux kernel will print some information on all matching
 packets (like most IPv6 IPv6-header	fields)  via  the  kernel  log
       (where it can be read with dmesg or syslogd(8)).  This is a "non-terminating
 target", i.e. rule traversal continues at the next rule.	So  if
       you want to LOG the packets you refuse, use two separate rules with the
       same matching criterias, first using target LOG then DROP (or  REJECT).

       --log-level level
	      Level of logging (numeric or see syslog.conf(5)).

       --log-prefix prefix
	      Prefix  log messages with the specified prefix; up to 29 letters
	      long, and useful for distinguishing messages in the logs.

       --log-tcp-sequence
	      Log TCP sequence numbers. This is a security risk if the log  is
	      readable by users.

       --log-tcp-options
	      Log options from the TCP packet header.

       --log-ip-options
	      Log options from the IPv6 packet header.

   MARK    [Toc]    [Back]
       This  is  used  to  set	the  netfilter	mark value associated with the
       packet.	It is only valid in the mangle table.

       --set-mark mark

   REJECT    [Toc]    [Back]
       This is used to send back an error packet in response  to  the  matched
       packet:	otherwise it is equivalent to DROP so it is a terminating TARGET,
 ending rule traversal.  This target is only valid  in  the	INPUT,
       FORWARD	and  OUTPUT  chains,  and  user-defined  chains which are only
       called from those chains.  The following option controls the nature  of
       the error packet returned:

       --reject-with type
	      The  type  given can be icmp6-no-route, no-route, icmp6-adm-pro-
	      hibited, adm-prohibited,	icmp6-addr-unreachable,  addr-unreach,
	      icmp6-port-unreachable, port-unreach, which return the appropriate
 IPv6-ICMP  error  message  (port-unreach  is	the  default).
	      Finally,	the  option  tcp-reset can be used on rules which only
	      match the TCP protocol: this causes a TCP RST packet to be  sent
	      back.  This is mainly useful for blocking ident (113/tcp) probes
	      which frequently occur when sending mail to  broken  mail  hosts
	      (which won't accept your mail otherwise).

DIAGNOSTICS    [Toc]    [Back]

       Various error messages are printed to standard error.  The exit code is
       0 for correct functioning.  Errors which appear to be caused by invalid
       or  abused  command  line parameters cause an exit code of 2, and other
       errors cause an exit code of 1.

BUGS    [Toc]    [Back]

       Check is not implemented (yet).

COMPATIBILITY WITH IPCHAINS    [Toc]    [Back]

       This ip6tables is very similar to ipchains by Rusty Russell.  The  main
       difference  is  that the chains INPUT and OUTPUT are only traversed for
       packets coming into the local host and originating from the local  host
       respectively.   Hence every packet only passes through one of the three
       chains; previously a forwarded packet would pass through all three.

       The other main difference is that -i refers to the input interface;  -o
       refers  to  the	output	interface,  and both are available for packets
       entering the  FORWARD  chain.   There  are  several  other  changes  in
       ip6tables.

SEE ALSO    [Toc]    [Back]

      
      
       The  packet-filtering-HOWTO,  which  details  more  iptables  usage for
       packet filtering, the NAT-HOWTO, which details NAT, and the  netfilterhacking-HOWTO
 which details the internals.
       See http://www.netfilter.org/.

AUTHORS    [Toc]    [Back]

       Rusty  Russell wrote iptables, in early consultation with Michael Neuling.


       Marc Boucher made Rusty abandon ipnatctl  by  lobbying  for  a  generic
       packet  selection  framework  in iptables, then wrote the mangle table,
       the owner match, the mark stuff, and ran around doing cool stuff everywhere.


       James Morris wrote the TOS target, and tos match.

       Jozsef Kadlecsik wrote the REJECT target.

       Harald Welte wrote the ULOG target, TTL match+target and libipulog.

       The  Netfilter Core Team is: Marc Boucher, Jozsef Kadlecsik, James Morris,
 Harald Welte and Rusty Russell.

       ip6tables man page created by Andras Kis-Szabo, based on  iptables  man
       page written by Herve Eychenne <rv@wallfire.org>.




				 Mar 09, 2002			  IP6TABLES(8)
[ Back ]
 Similar pages
Name OS Title
iptables Linux IP packet filter administration
ipfstat FreeBSD reports on packet filter statistics and filter list
pf OpenBSD packet filter
packetfilter Tru64 Ethernet packet filter
pfil_hook_get FreeBSD packet filter interface
pfil FreeBSD packet filter interface
pfil_remove_hook FreeBSD packet filter interface
bpf OpenBSD Berkeley Packet Filter
pfil_add_hook FreeBSD packet filter interface
pfil NetBSD packet filter interface
Copyright © 2004-2005 DeniX Solutions SRL
newsletter delivery service