
iptables man Pages D-7
a user-defined chain (other than the one this rule
is in), one of the special builtin targets which
decide the fate of the packet immediately, or an
extension (see EXTENSIONS below). If this option
is omitted in a rule, then matching the rule will
have no effect on the packet's fate, but the coun
ters on the rule will be incremented.
-i, --in-interface [!] [name]
Optional name of an interface via which a packet is
received (for packets entering the INPUT, FORWARD
and PREROUTING chains). When the "!" argument is
used before the interface name, the sense is
inverted. If the interface name ends in a "+",
then any interface which begins with this name will
match. If this option is omitted, the string "+"
is assumed, which will match with any interface
name.
-o, --out-interface [!] [name]
Optional name of an interface via which a packet is
going to be sent (for packets entering the FORWARD,
OUTPUT and POSTROUTING chains). When the "!" argu
ment is used before the interface name, the sense
is inverted. If the interface name ends in a "+",
then any interface which begins with this name will
match. If this option is omitted, the string "+"
is assumed, which will match with any interface
name.
[!] -f, --fragment
This means that the rule only refers to second and
further fragments of fragmented packets. Since
there is no way to tell the source or destination
ports of such a packet (or ICMP type), such a
packet will not match any rules which specify them.
When the "!" argument precedes the "-f" flag, the
rule will only match head fragments, or unfrag
mented packets.
Comentários a estes Manuais