Show Table of Contents
220.127.116.11. Additional Match Option Modules
Additional match options are also available through modules loaded by the
iptablescommand. To use a match option module, load the module by name using the
-moption, such as
-m <module-name>(replacing <module-name> with the name of the module).
A large number of modules are available by default. It is even possible to create modules that provide additional functionality.
The following is a partial list of the most commonly used modules:
limitmodule — Places limits on how many packets are matched to a particular rule. This is especially beneficial when used in conjunction with the
LOGtarget as it can prevent a flood of matching packets from filling up the system log with repetitive messages or using up system resources. Refer to Section 18.3.5, “Target Options” for more information about the
limitmodule enables the following options:
--limit— Sets the number of matches for a particular range of time, specified with a number and time modifier arranged in a
<number>/<time>format. For example, using
--limit 5/houronly lets a rule match
5times in a single hour.If a number and time modifier are not used, the default value of
--limit-burst— Sets a limit on the number of packets able to match a rule at one time. This option should be used in conjunction with the
--limitoption, and it accepts a number to set the burst threshold.If no number is specified, only five packets are initially able to match the rule.
statemodule — Enables state matching.The
statemodule enables the following options:
--state— match a packet with the following connection states:
These connection states can be used in combination with one another by separating them with commas, such as
ESTABLISHED— The matching packet is associated with other packets in an established connection.
INVALID— The matching packet cannot be tied to a known connection.
NEW— The matching packet is either creating a new connection or is part of a two-way connection not previously seen.
RELATED— The matching packet is starting a new connection related in some way to an existing connection.
-m state --state INVALID,NEW.
macmodule — Enables hardware MAC address matching.The
macmodule enables the following option:
--mac-source— Matches a MAC address of the network interface card that sent the packet. To exclude a MAC address from a rule, place an exclamation point character (
!) after the
To view other match options available through modules, refer to the