right-hand side of a (typically implicit) relational expression to change the
expression on the left-hand side into a boolean check (usually for existence). +
-The following keywords will automatically resolve into a boolean type with given value:
-The bitmask type (bitmask) is used for bitmasks.
+.The following keywords will automatically resolve into a boolean type with given value
[options="header"]
|==================
|Keyword | Value
-|exits |
+|exists |
1 |
missing |
0
|===================
-[options="header"]
-|======================================
-|Expression | Behaviour
-|fib |
-Check route existence.
-|exthdr|
-Check IPv6 extension header existence.
-|tcp option |
-Check TCP option header existence.
-|===================
-
-.expressions support a boolean comparison:
+.expressions support a boolean comparison
[options="header"]
|======================================
|Expression | Behaviour
[options="header"]
|==================
|Name | Keyword | Size | Base type
-|ICMP Type |
-icmp_type |
+|ICMP Code |
+icmp_code |
8 bit |
integer
|===================
The ICMP Code type is used to conveniently specify the ICMP header's code field.
-.Keywords may be used when specifying the ICMP type
+.Keywords may be used when specifying the ICMP code
[options="header"]
|==================
|Keyword | Value
|==================
|Name | Keyword | Size | Base type
|ICMPv6 Code |
-icmpv6_type |
+icmpv6_code |
8 bit |
integer
|===================
4 byte|
bitmask
|conntrack event bits|
-ct_events |
+ct_event |
4 byte |
bitmask
|conntrack label|
|expected|
1
|seen-reply|
-1
+2
|assured|
4
|confirmed|
-------
[verse]
{list | flush} *ruleset* ['family']
-\{export\} [*ruleset*] {'format'}
+export [*ruleset*] 'format'
The *ruleset* keyword is used to identify the whole set of tables, chains, etc.
currently in place in kernel. The following *ruleset* commands exist:
one. If the referred rule was deleted, the command is rejected by the kernel
just as if an invalid 'handle' was given.
-*add*::
-Add a new rule described by the list of statements. The rule is appended to the
-given chain unless a position is specified, in which case the rule is appended
-to the rule given by the 'handle'. The alternative name position is deprecated
-and should not be used anymore.
-
+[horizontal]
+*add*:: Add a new rule described by the list of statements. The
+rule is appended to the given chain unless a position is specified, in which
+case the rule is appended to the rule given by the 'handle'. The alternative
+name position is deprecated and should not be used anymore.
*insert*:: Similar to the *add* command, but the rule is prepended to the
-beginning of the chain or before the rule at the given position.
-
+beginning of the chain or before the rule with the given 'handle'.
*replace*:: Similar to the add command, but the rule replaces the specified
rule.
-
*delete*:: Delete the specified rule.
.*add a rule to ip table input chain*
ether_type
|==================
-.ARP HEADER EXPRESSION
+ARP HEADER EXPRESSION
+~~~~~~~~~~~~~~~~~~~~~
+[verse]
+*arp* ['ARP' 'header' 'field']
+
+.ARP header expression
[options="header"]
|==================
|Keyword| Description| Type
to manually exclude packets that have a different transport header, for instance
my using meta l4proto 5 before the raw expression.
-.Support payload protocol bases
+.Supported payload protocol bases
[options="header"]
|==================
|Base| Description
integer (64 bit)
|zone|
conntrack zone |
-integer (64 bit)
+integer (16 bit)
|==========================================
A description of conntrack-specific types listed above can be found sub-section CONNTRACK TYPES above.
integer (32 bit)
|l4proto|
layer 4 protocol, skips ipv6 extension headers|
-integer (32 bit)
+integer (8 bit)
|protocol|
EtherType protocol value|
ether_type
ifname
|iiftype|
Input interface type|
-iface_itype
+iface_type
|oif|
Output interface index|
iface_index
quoted string (e.g. "ftp")
|protocol |
layer 4 protocol of the helper |
-address family (e.g. ip)
+string (e.g. ip)
|l3proto |
layer 3 protocol of the helper |
address family (e.g. ip)
unsigned integer (32 bit)
|==================================
-.log statement options
+.log-flags
[options="header"]
|==================
| Flag | Description
.limit statement values
[options="header"]
|==================
-|Value | Description | Type|
+|Value | Description | Type
|packet_number |
Number of packets |
unsigned integer (32 bit)