18.3.4. iptables Match Options
Different network protocols provide specialized matching options which can be configured to match a particular packet using that protocol. However, the protocol must first be specified in the
iptablescommand. For example
-p tcp <protocol-name>(where <protocol-name> is the target protocol), makes options for the specified protocol available.
22.214.171.124. TCP Protocol
These match options are available for the TCP protocol (
--dport— Sets the destination port for the packet. Use either a network service name (such as
smtp), port number, or range of port numbers to configure this option. To browse the names and aliases of network services and the port numbers they use, view the
--destination-portmatch option is synonymous with
--dport.To specify a range of port numbers, separate the two numbers with a colon (
:), such as
-p tcp --dport 3000:3200. The largest acceptable valid range is
0:65535.Use an exclamation point character (
!) after the
--dportoption to match all packets which do not use that network service or port.
--sport— Sets the source port of the packet using the same options as
--source-portmatch option is synonymous with
--syn— Applies to all TCP packets designed to initiate communication, commonly called SYN packets. Any packets that carry a data payload are not touched. Placing an exclamation point character (
!) as a flag after the
--synoption causes all non-SYN packets to be matched.
--tcp-flags— Allows TCP packets with specific set bits, or flags, to match a rule. The
--tcp-flagsmatch option accepts two parameters. The first parameter is the mask, which sets the flags to be examined in the packet. The second parameter refers to the flag that must be set to match.The possible flags are:
For example, an
iptablesrule which contains
-p tcp --tcp-flags ACK,FIN,SYN SYNonly matches TCP packets that have the SYN flag set and the ACK and FIN flags unset.Using the exclamation point character (
--tcp-flagsreverses the effect of the match option.
--tcp-option— Attempts to match with TCP-specific options that can be set within a particular packet. This match option can also be reversed with the exclamation point character (