.\"
.\" Man page written by Herve Eychenne <rv@wallfire.org> (May 1999)
.\" It is based on ipchains page.
.\" TODO: add a word for protocol helpers (FTP, IRC, SNMP-ALG)
.\"
.\" ipchains page by Paul ``Rusty'' Russell March 1997
.\" Based on the original ipfwadm man page by Jos Vos <jos@xos.nl>
.\"
.\"	This program is free software; you can redistribute it and/or modify
.\"	it under the terms of the GNU General Public License as published by
.\"	the Free Software Foundation; either version 2 of the License, or
.\"	(at your option) any later version.
.\"
.\"	This program is distributed in the hope that it will be useful,
.\"	but WITHOUT ANY WARRANTY; without even the implied warranty of
.\"	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
.\"	GNU General Public License for more details.
.\"
.\"	You should have received a copy of the GNU General Public License
.\"	along with this program; if not, write to the Free Software
.\"	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
.\"
.\"
.\" Japanese Version Copyright (c) 2001, 2004 Yuichi SATO
.\"         all right reserved.
.\" Translated Sun Jul 29 01:03:37 JST 2001
.\"         by Yuichi SATO <ysato@h4.dion.ne.jp>
.\" Updated & Modified Wed Sep 12 06:22:55 JST 2001 by Yuichi SATO
.\" Updated on Wed May 28 01:51:45 JST 2003 by
.\"    System Design and Research Institute Co., Ltd.
.\" Updated & Modified Sat Feb 21 23:28:25 JST 2004
.\"         by Yuichi SATO <ysato444@yahoo.co.jp>
.\"
.\"WORD:	chain		
.\"WORD:	built-in chain	Ȥ߹ߺѤߥ
.\"WORD:	connection tracking	³
.\"WORD:	enslave		졼֤ˤ
.\"WORD:	infrastructure	
.\"WORD:	round-robin	饦ɡӥ
.\"WORD:	rule traverse	롼θƤ
.\"WORD:	non-terminating target	λå
.\"WORD:	criteria	Ƚ()
.\"
.TH IPTABLES 8 "Mar 09, 2002" "" ""
.SH ̾
iptables \- IPv4 Υѥåȥե륿 NAT ġ
.SH 
.BR "iptables [-t table] -[AD] " " 롼ξܺ [ץ]"
.br
.BR "iptables [-t table] -I " " [롼ֹ] 롼ξܺ [ץ]"
.br
.BR "iptables [-t table] -R " " 롼ֹ 롼ξܺ [ץ]"
.br
.BR "iptables [-t table] -D " " 롼ֹ [ץ]"
.br
.BR "iptables [-t table] -[LFZ] " "[] [ץ]"
.br
.BR "iptables [-t table] -N " ""
.br
.BR "iptables [-t table] -X " "[]"
.br
.BR "iptables [-t table] -P " " å [ץ]"
.br
.BR "iptables [-t table] -E " "̾ ̾"
.SH 
.B iptables
 Linux ͥ IP ѥåȥե륿롼Υơ֥
ꡦ뤿˻Ȥ롣
ʣΰۤʤơ֥Ǥ롣
ƥơ֥ˤϤȤ߹ߺѤߥ󤬴ޤޤƤꡢ
˥桼Υä뤳ȤǤ롣

ƥϡѥåȷ˥ޥå롼ΥꥹȤǤ롣
ƥ롼ϥޥåѥåȤФƲ򤹤뤫ꤹ롣
ϡ֥åȡפȸƤФ졢
Ʊơ֥Υ桼˥פ뤳ȤǤ롣

.SH å
ҤȤĤΥե롼Ǥϡ
ѥåȤȽǤȥåȤȤꤵ롣
ѥåȤޥåʤ硢μΥ롼뤬ɾ롣
ѥåȤޥå硢
åȤͤΥ롼ꤹ롣
åȤͤϡ桼̾ޤ̤
.IR ACCEPT ,
.IR DROP ,
.IR QUEUE ,
.I RETURN
Τ 1 ĤǤ롣
.PP
.I ACCEPT 
ϥѥåȤ̤Ȥ̣Ǥ롣
.I DROP
ϥѥåȤ򾲤 (ΤƤ) Ȥ̣Ǥ롣
.I QUEUE
ϥѥåȤ桼֤ϤȤ̣Ǥ
(ͥ뤬ݡȤƤФǤ뤬)
.I RETURN
ϡΥθƤߤơ
 (ƤӽФ) 
Υ롼뤫鸡ƤƳȤ̣Ǥ롣
Ȥ߹ߺѤߥκǸã硢
ޤȤ߹ߺѤߥǥå
.I RETURN
ĥ롼˥ޥå硢
ݥꥷǻꤵ줿åȤ
ѥåȤιꤹ롣
.SH ơ֥
ߤΤȤ 3 ĤΩʥơ֥뤬¸ߤ
(ǤɤΥơ֥뤬¸ߤ뤫ϡ
ͥɤä⥸塼뤬¸ߤ뤫˰¸)
.TP
.BI "-t, --table " "table"
ΥץϡΥޥɤŬѤ
ѥåȥޥå󥰥ơ֥ꤹ롣
ͥ˼ư⥸塼ǥ󥰤ꤵƤ硢
Υơ֥ФŬڤʥ⥸塼뤬ޤɤƤʤС
Υ⥸塼뤬ɤ롣

ơ֥ϰʲ̤Ǥ롣
.RS
.TP .4i
.BR "filter" :
(\-t ץϤʤ) 줬ǥեȤΥơ֥Ǥ롣
ˤ
.B INPUT
(ޥΤäƤѥåȤФ)
.B FORWARD
(ޥͳѥåȤФ)
.B OUTPUT
(ޥ줿ѥåȤФ)
ȤȤ߹ߺѤߥ󤬴ޤޤ롣
.TP
.BR "nat" :
Υơ֥Ͽ³򳫤褦ʥѥåȤФƻȤ롣
ˤ
.B PREROUTING
(ѥåȤäƤ硢ˤΥѥåȤѴ뤿Υ)
.B OUTPUT
(줿ѥåȤ롼ƥ󥰤Ѵ뤿Υ)
.B POSTROUTING
(ѥåȤФƹԤȤѴ뤿Υ)
Ȥ 3 ĤȤ߹ߺѤߥ󤬴ޤޤ롣
.TP
.BR "mangle" :
Υơ֥̤ʥѥåѴ˻Ȥ롣
ˤϡͥ 2.4.17 ޤǤ
.B PREROUTING
(ѥåȤäƤ硢ˤΥѥåȤѴ뤿Υ)
.B OUTPUT
(줿ѥåȤ롼ƥ󥰤Ѵ뤿Υ)
Ȥ 2 ĤȤ߹ߺѤߥ󤬴ޤޤ롣
ͥ 2.4.18 ϡ¾
.B INPUT
(ޥΤäƤѥåȤФ)
.B FORWARD
(ޥͳѥåȤФ)
.B POSTROUTING
(ѥåȤФƹԤȤѴ뤿Υ)
Ȥ 3 ĤȤ߹ߺѤߥޤޤ롣
.RE
.SH ץ
.B iptables
ǻȤ륪ץϡĤΥ롼פʬ롣
.SS ޥ
Υץϡ¹Ԥưꤹ롣
ʲƤʤ¤ꡢ
ޥɥ饤ǻǤΤϤ 1 ĤǤ롣
ĹСΥޥ̾ȥץ̾ϡ
.B iptables
¾Υޥ̾䥪ץ̾ȶ̤ǤϰϤ
(ʸά) ꤹ뤳ȤǤ롣
.TP
.BI "-A, --append " " 롼ξܺ"
򤵤줿κǸ 1 İʾΥ롼ɲä롣
̾ 1 İʾΥɥ쥹˲褵줿ϡ
ǽʥɥ쥹ȹ礻줾Фƥ롼뤬ɲä롣
.TP
.BI "-D, --delete " " 롼ξܺ"
.ns
.TP
.BI "-D, --delete " " 롼ֹ"
򤵤줿󤫤 1 İʾΥ롼롣
Υޥɤˤ 2 ĤλȤ:
ֹ (ǽΥ롼 1 Ȥ) ꤹȡ
ޥå롼ꤹǤ롣
.TP
.BR  "-I, --insert " "\fI\fP [\fI롼ֹ\fP] \fI롼ξܺ"
򤵤줿˥롼ֹꤷ 1 İʾΥ롼롣
롼ֹ椬 1 ξ硢롼ϥƬ롣
ϥ롼ֹ椬ꤵʤΥǥեȤǤ⤢롣
.TP
.BI  "-R, --replace " " 롼ֹ 롼ξܺ"
򤵤줿ǥ롼ִ롣
̾ 1 İʾΥɥ쥹˲褵줿ϡ
ΥޥɤϼԤ롣롼ֹ 1 Ϥޤ롣
.TP
.BR  "-L, --list " "[\fI\fP]"
򤵤줿ˤƤΥ롼ɽ롣
󤬻ꤵʤ硢ƤΥˤꥹȤɽ롣
¾γ iptables ޥɤƱͤˡꤵ줿ơ֥
(ǥեȤ filter) ФƺѤ롣
ä NAT 롼ɽˤϰʲΤ褦ˤ롣
.nf
 iptables -t nat -n -L
.fi
DNSεհ򤱤뤿ˡ褯
.B -n
ץȶ˻Ѥ롣
.B -Z
() ץƱ˻ꤹ뤳ȤǤ롣
ξ硢˥ꥹȤơ
(: ѥåȥ󥿤ȥХȥ󥿤) ˤ롣
ɽƱͿ줿¾ΰ˱ƶ롣
.nf
 iptables -L -v
.fi
Ȥʤ¤ (: -v ץꤷʤ¤)
ºݤΥ롼뤽ΤΤɽʤ
.TP
.BR "-F, --flush " "[\fI\fP]"
򤵤줿(ꤷʤХơ֥ƤΥ)
Ƥõ롣
ƤΥ롼 1 ĤĺΤƱǤ롣
.TP
.BR "-Z, --zero " "[\fI\fP]"
٤ƤΥΥѥåȥ󥿤ȥХȥ󥿤򥼥ˤ롣
ꥢľΥ󥿤򸫤뤿ˡ
.B "-L, --list"
(ɽ) ץƱ˻ꤹ뤳ȤǤ (嵭򻲾)
.TP
.BI "-N, --new-chain " ""
ꤷ̾ǥ桼롣
Ʊ̾ΥåȤ¸ߤƤϤʤʤ
.TP
.BR "-X, --delete-chain " "[\fI\fP]"
ꤷ桼롣
Υ󤬻ȤƤƤϤʤʤ
ˡΥ򻲾ȤƤ롼
뤫֤뤫ʤФʤʤ
Ϳʤ硢ơ֥ˤΤ
Ȥ߹ߺѤߥǤʤΤƺ롣
.TP
.BI "-P, --policy " " å"
Υݥꥷ򡢻ꤷåȤꤹ롣
ǽʥåȤϡ\fBå\fRפξϤ򻲾Ȥ뤳ȡ
(桼ǤϤʤ)Ȥ߹ߺѤߥˤݥꥷǤʤ
ޤȤ߹ߺѤߥ桼
ݥꥷΥåȤꤹ뤳ȤϤǤʤ
.TP
.BI  "-E, --rename-chain " "̾ ̾"
桼ꤷ̾ѹ롣
ϸܤѹʤΤǡơ֥ι¤ˤϲƶʤ
.TP
.B -h
إס
(ΤȤϤȤƤñ) ޥɽ񼰤ɽ롣
.SS ѥ᡼
ʲΥѥ᡼ (add, delete, insert, 
replace, append ޥɤѤ) 롼λͤ롣
.TP
.BR "-p, --protocol " "[!] \fIprotocol\fP"
롼ǻȤץȥ롢ޤϥåѥåȤΥץȥ롣
Ǥץȥϡ
.IR tcp ,
.IR udp ,
.IR icmp ,
.I all
Τ줫 1 ĤͤǤ롣
ͤˤϡΥץȥΤɤ줫ʤ̤Υץȥɽ
ͤꤹ뤳ȤǤ롣
/etc/protocols ˤץȥ̾Ǥ롣
ץȥ "!" ֤ȡΥץȥȤ̣ˤʤ롣
 0 
.I all

ץȥ
.I all
ƤΥץȥȥޥå
Υץ󤬾ά줿ݤΥǥեȤǤ롣
.TP
.BR "-s, --source " "[!] \fIaddress\fP[/\fImask\fP]"
λꡣ
.I address
ϥۥ̾
(DNS Τ褦ʥ⡼Ȥؤ䤤碌Dz褹̾ꤹΤɤʤ)
ͥåȥ IP ɥ쥹 (/mask ꤹ)
̾ IP ɥ쥹Τ줫Ǥ롣
.I mask
ϥͥåȥޥ
ͥåȥޥκ¦ˤ 1 οꤹͤǤ롣
Ĥޤꡢ
.I 24
Ȥ mask 
.I 255.255.255.0

ɥ쥹 "!" ֤ȡΥɥ쥹Ȥ̣ˤʤ롣
ե饰
.B --src
ϡΥץ̾Ǥ롣
.TP
.BR "-d, --destination " "[!] \fIaddress\fP[/\fImask\fP]"
λꡣ
񼰤ξܤˤĤƤϡ
.B -s
() ե饰򻲾Ȥ뤳ȡ
ե饰
.B --dst
ϡΥץ̾Ǥ롣
.TP
.BI "-j, --jump " "target"
롼ΥåȡĤޤꡢ
ѥåȤޥåˤɤ뤫ꤹ롣
åȤϥ桼
(Υ롼뼫ȤäƤʳ) Ǥ⡢
ѥåȤι¨˷ꤹ̤Ȥ߹ߺѤߥåȤǤ⡢
ĥ줿å (ʲ
.RB  åȤγĥ 
򻲾) Ǥ褤
Υץ󤬥롼˻ꤵʤäϡ
롼˥ޥåƤѥåȤι˲ƶʤ
롼Υ󥿤 1 IJû롣
.TP
.BR "-i, --in-interface " "[!] \fIname\fP"
ѥåȤ뤳Ȥˤʤ륤󥿡ե̾
.RB ( INPUT ,
.BR FORWARD ,
.B PREROUTING
ѥåȤΤ)
󥿡ե̾ "!" ֤ȡ
Υ󥿡եȤ̣ˤʤ롣
󥿡ե̾ "+" ǽäƤ硢
̾ǻϤޤǤդΥ󥿡ե̾˥ޥå롣
Υץ󤬾ά줿硢
ǤդΥ󥿡ե̾˥ޥå롣
.TP
.BR "-o, --out-interface " "[!] \fIname\fP"
ѥåȤ뤳Ȥˤʤ륤󥿡ե̾
.RB ( FORWARD ,
.BR OUTPUT , 
.B POSTROUTING
ѥåȤΤ)
󥿡ե̾ "!" ֤ȡ
Υ󥿡եȤ̣ˤʤ롣
󥿡ե̾ "+" ǽäƤ硢
̾ǻϤޤǤդΥ󥿡ե̾˥ޥå롣
Υץ󤬾ά줿硢
ǤդΥ󥿡ե̾˥ޥå롣
.TP
.B "[!] " "-f, --fragment"
Υץϡʬ䤵줿ѥå (fragmented packet) Τ
2 ܰʹߤΥѥåȤ򻲾Ȥ롼Ǥ뤳Ȥ̣롣
Τ褦ʥѥå (ޤ ICMP פΥѥå) 
ݡȤΤˡʤΤǡ
ꤹ褦ʥ롼ˤϥޥåʤ
"-f" ե饰 "!" ֤ȡ
ʬ䤵줿ѥåȤΤǽΤΤ
ʬ䤵ƤʤѥåȤ˥ޥå롣
.TP
.BI "-c, --set-counters " "PKTS BYTES"
ΥץȤȡ
.RB ( insert ,
.BR append ,
.B replace
ˤ) Ԥϥѥåȥ󥿤ȥХȥ󥿤
뤳ȤǤ롣
.SS ¾Υץ
¾˰ʲΥץꤹ뤳ȤǤ:
.TP
.B "-v, --verbose"
ܺ٤ʽϤԤ
list ޥɤκݤˡ󥿡ե̾
(⤷) 롼ΥץTOS ޥɽ롣
ѥåȤȥХȥ󥿤ɽ롣
ź 'K', 'M', 'G' ϡ
줾 1000, 1,000,000, 1,000,000,000 ܤɽ
(ѹ
.B -x
ե饰⸫)
Υץ append, insert, delete, replace ޥɤŬѤȡ
롼ˤĤƤξܺ٤ʾɽ롣
.TP
.B "-n, --numeric"
ͤˤϤԤ
IP ɥ쥹ݡֹͤˤեޥåȤɽ롣
ǥեȤǤϡiptables  (ǽǤ) ξ
ۥ̾ͥåȥ̾ӥ̾ɽ褦Ȥ롣
.TP
.B "-x, --exact"
̩ʿͤɽ롣
ѥåȥ󥿤ȥХȥ󥿤
K (1000 βܤ)M (1000K βܤ)G (1000M βܤ) ǤϤʤ
̩ͤɽ롣
Υץϡ
.B -L
ޥɤȤطʤ
.TP
.B "--line-numbers"
롼ɽݡΥ롼뤬Τɤΰ֤ˤ뤫ɽ
ֹƹԤλϤղä롣
.TP
.B "--modprobe=command"
˥롼ɲäޤݤˡ
(åȤޥå󥰤γĥʤɤ) ɬפʥ⥸塼ɤ뤿˻Ȥ
.B command
ꤹ롣
.SH ޥå󥰤γĥ
iptables ϳĥ줿ѥåȥޥå󥰥⥸塼ȤȤǤ롣
Υ⥸塼 2 ˡǥɤ:
⥸塼ϡ
.B -p
ޤ
.B --protocol
ǰۤΤ˻ꤵ뤫
.B -m
ޤ
.B --match
θ˥⥸塼̾³ƻꤵ롣
Υ⥸塼θˤϡ⥸塼˱
¾Τʥޥɥ饤󥪥ץꤹ뤳ȤǤ롣
ʣγĥޥå󥰥⥸塼Ԥǻꤹ뤳ȤǤ롣
ޤ⥸塼ͭΥإפɽ뤿ˤϡ
⥸塼ꤷ
.B -h
ޤ
.B --help
ꤹФ褤

ʲγĥ١ѥå˴ޤޤƤ롣
ʬΤΤϡ
.B !
ˤȤˤä
ޥå󥰤ΰ̣դˤǤ롣
.SS ah
Υ⥸塼 IPSec ѥåȤ AH إå SPI ͤ˥ޥå롣 
.TP
.BR "--ahspi " "[!] \fIspi\fP[:\fIspi\fP]"
.SS conntrack
Υ⥸塼ϡ³ (connection tracking) Ȥ߹碌Ѥȡ
"state" ޥå⤵¿Ρ
ѥåȤˤĤƤ³׾֤Τ뤳ȤǤ
(εǽ򥵥ݡȤͥΤȤ iptables ѥ뤵줿
ˤΤߡΥ⥸塼¸ߤ)
.TP
.BI "--ctstate " "state"
state ϡޥåоݤȤʤ롢޶ڤ³֥ꥹȤǤ롣
ǽ state ϰʲ̤ꡣ
.BR INVALID :
Ȥ̤٤䡢
Τ³Ȥбʤ ICMP 顼ʤɡ
餫ͳˤѥåȤ̤Ǥʤ
.BR ESTABLISHED :
ΥѥåȤϡ˥ѥåȤꤵ줿³°ѥåȤǤ롣
.BR NEW :
ΥѥåȤ³򳫻Ϥ
ˤϥѥåȤꤵƤʤ³°ѥåȤǤ롣
.BR RELATED :
ΥѥåȤ³򳫻ϤƤ뤬
FTP ǡž ICMP 顼Τ褦ˡ¸³˴طƤ롣
.BR SNAT :
Ūʾ֤Ǥꡢ񤭴ɥ쥹ΰ襢ɥ쥹
ۤʤ˥ޥå롣
.BR DNAT :
Ūʾ֤Ǥꡢ񤭴ΰ襢ɥ쥹ɥ쥹
ۤʤ˥ޥå롣
.TP
.BI "--ctproto " "proto"
(̾ޤϿͤ) ꤵ줿ץȥ˥ޥå롣
.TP
.BI "--ctorigsrc " "[!] \fIaddress\fP[/\fImask\fP]"
񤭴ɥ쥹˥ޥå롣
.TP
.BI "--ctorigdst " "[!] \fIaddress\fP[/\fImask\fP]"
񤭴ΰ襢ɥ쥹˥ޥå롣
.TP
.BI "--ctreplsrc " "[!] \fIaddress\fP[/\fImask\fP]"
ɥ쥹˥ޥå롣
.TP
.BI "--ctrepldst " "[!] \fIaddress\fB[/\fImask\fP]"
ΰ襢ɥ쥹˥ޥå롣
.TP
.BI "--ctstatus " "[\fINONE|EXPECTED|SEEN_REPLY|ASSURED\fP][,...]"
³פŪʾ֤˥ޥå롣
.TP
.BI "--ctexpire " "\fItime\fP[\fI:time\fP]"
֤ͭλĤÿޤϤϰ(ξüޤ)˥ޥå롣
.SS dscp
Υ⥸塼ϡIP إå TOS եˤ롢
6 bit  DSCP եɤ˥ޥå롣
IETF Ǥ DSCP  TOS ˼ää
.TP
.BI "--dscp " "value"
(10 ʤޤ 16 ʤ)  [0\-63] ˥ޥå롣
.TP
.BI "--dscp-class " "\fIDiffServ Class\fP"
DiffServ 饹˥ޥå롣
ͤ BE, EF, AFxx, CSx 饹Τ줫Ǥ롣
ϡбͤǻꤹΤƱǤ롣
.SS esp
Υ⥸塼 IPSec ѥåȤ ESP إå SPI ͤ˥ޥå롣 
.TP
.BR "--espspi " "[!] \fIspi\fP[:\fIspi\fP]"
.SS helper
Υ⥸塼ϡꤵ줿³ץإѡ⥸塼
ϢѥåȤ˥ޥå롣
.TP
.BI "--helper " "string"
ꤵ줿³ץإѡ⥸塼
ϢѥåȤ˥ޥå롣
.RS
.PP
ǥեȤΥݡȤȤä ftp-å˴ϢѥåȤǤϡ
string  "ftp" Ƚ񤱤롣
¾ΥݡȤǤ "\-ݡֹ" ͤդä롣
ʤ "ftp-2121" Ȥʤ롣
.PP
¾³ץإѡǤƱ롼뤬ŬѤ롣
.RE
.SS icmp
γĥ `--protocol icmp' ꤵ줿˥ɤ졢
ʲΥץ󶡤:
.TP
.BR "--icmp-type " "[!] \fItypename\fP"
ͤ ICMP סޤϥޥ
.nf
 iptables -p icmp -h
.fi
ɽ ICMP ̾Ǥ롣
.SS length
Υ⥸塼ϡꤵ줿ѥåĹޤϤϰϤ˥ޥå롣
.TP
.BR "--length " "\fIlength\fP[:\fIlength\fP]"
.SS limit
Υ⥸塼ϡȡХĥե륿Ȥ
ñ̻֤¤줿ޥå롣
γĥȤä롼ϡ(`!' ե饰ꤵʤ¤)
¤ãޤǥޥå롣
Υ⥸塼㤨СϿ¤뤿
.B LOG
åȤȤ߹碌ƻȤȤǤ롣
.TP
.BI "--limit " "rate"
ñ̻֤ʿѥޥåκ͡
ͤǻꤵ졢ź `/second', `/minute',
`/hour', `/day' դ뤳ȤǤ롣
ǥեȤ 3/hour Ǥ롣
.TP
.BI "--limit-burst " "number"
ѥåȤޥåκ:
ޥåκͤϡ
Υץǻꤷ¤ãʤС
٤Ȥˡοͤˤʤޤ 1 Ĥ䤵롣
ǥեȤ 5 Ǥ롣
.SS mac
.TP
.BR "--mac-source " "[!] \fIaddress\fP"
 MAC ɥ쥹˥ޥå롣
.I address
 XX:XX:XX:XX:XX:XX ȤǤʤФʤʤ
ͥåȥǥХäƤѥåȤǡ
.BR PREROUTING ,
.BR FORWARD ,
.B INPUT
ѥåȤˤ̣ʤ
.SS mark
Υ⥸塼ϥѥåȤ˴ϢŤ줿
netfilter  mark եɤ˥ޥå
(Υեɤϡʲ
.B MARK
åȤꤵ)
.TP
.BR "--mark " "\fIvalue\fP[/\fImask\fP]"
ꤵ줿ʤ mark ͤΥѥåȤ˥ޥå
(mask ꤵȡӤ mask Ȥ (AND) Ȥ)
.SS multiport
Υ⥸塼ΥݡȤν˥ޥå롣
ݡȤ 15 ĤޤǻǤ롣
Υ⥸塼
.B "-p tcp"
ޤ
.B "-p udp"
Ȥ߹碌ƻȤȤǤʤ
.TP
.BR "--source-ports " "\fIport\fP[,\fIport\fP[,\fIport\fP...]]"
ݡȤꤵ줿ݡȤΤΤ줫ǤХޥå롣
ե饰
.B --sports
ϡΥץ̾Ǥ롣
.TP
.BR "--destination-ports " "\fIport\fP[,\fIport\fP[,\fIport\fP...]]"
ݡȤꤵ줿ݡȤΤΤ줫ǤХޥå롣
ե饰
.B --dports
ϡΥץ̾Ǥ롣
.TP
.BR "--ports " "\fIport\fP[,\fIport\fP[,\fIport\fP...]]"
ݡȤȰݡȤ
ĤΥݡȤꤵ줿ݡȤΤΤ줫ǤХޥå롣
.SS owner
Υ⥸塼ϡ줿ѥåȤդơ
ѥåԤΤФƥޥåԤ

.B OUTPUT
ΤߤǤͭǤʤ
ޤ(ICMP ping Τ褦) ѥåȤϡ
ͭԤʤΤФ˥ޥåʤ
.TP
.BI "--uid-owner " "userid"
ꤵ줿¸桼 ID Υץˤ
ѥåȤƤ˥ޥå롣
.TP
.BI "--gid-owner " "groupid"
ꤵ줿¸롼 ID Υץˤ
ѥåȤƤ˥ޥå롣
.TP
.BI "--pid-owner " "processid"
ꤵ줿ץ ID Υץˤ
ѥåȤƤ˥ޥå롣
.TP
.BI "--sid-owner " "sessionid"
ꤵ줿å󥰥롼פΥץˤ
ѥåȤƤ˥ޥå롣
.TP
.BI "--cmd-owner " "name"
ꤵ줿ޥ̾ĥץˤ
ѥåȤƤ˥ޥå
(εǽ򥵥ݡȤͥΤȤ iptables ѥ뤵줿
ˤΤߡΥ⥸塼¸ߤ)
.SS physdev
Υ⥸塼ϡ֥åǥХΥ졼֤ˤ줿
֥åݡȤϥǥХ˥ޥå롣
Υ⥸塼ϡ֥åˤƩŪ
IP եδפΰǤꡢ
ͥС 2.5.44 ʹߤǤΤͭǤ롣
.TP
.B --physdev-in name
ѥåȤ֥åΥݡ̾
.RB ( INPUT ,
.BR FORWARD ,
.B PREROUTING
ѥåȤΤ)
󥿡ե̾ "+" ǽäƤ硢
̾ǻϤޤǤդΥ󥿡ե̾˥ޥå롣
֥åǥХ̤ƼʤäѥåȤϡ
\&'!' ꤵƤʤ¤ꡢΥץ˥ޥåʤ
.TP
.B --physdev-out name
ѥåȤ뤳Ȥˤʤ֥åΥݡ̾
.RB ( FORWARD ,
.BR OUTPUT , 
.B POSTROUTING
ѥåȤΤ) 
󥿡ե̾ "+" ǽäƤ硢
̾ǻϤޤǤդΥ󥿡ե̾˥ޥå롣
.B nat

.B mangle
ơ֥
.B OUTPUT
Ǥϥ֥åνϥݡȤ˥ޥå뤳ȤǤʤ
.B filter
ơ֥
.B OUPUT
ǤϥޥåǽǤ롣
ѥåȤ֥åǥХʤä硢
ޤϥѥåȤνϥǥХǤäϡ
\&'!' ꤵƤʤ¤ꡢѥåȤϤΥץ˥ޥåʤ
.TP
.B --physdev-is-in
ѥåȤ֥å󥿡եä˥ޥå롣
.TP
.B --physdev-is-out
ѥåȤ֥å󥿡եФ褦Ȥ˥ޥå롣
.TP
.B --physdev-is-bridged
ѥåȤ֥å뤳Ȥˤꡢ
롼ƥ󥰤ʤä˥ޥå롣
 FORWARD, POSTROUTING ˤƤΤΩġ
.SS pkttype
Υ⥸塼ϡؤΥѥåȥפ˥ޥå롣
.TP
.BI "--pkt-type " "[\fIunicast\fP|\fIbroadcast\fP|\fImulticast\fP]"
.SS state
Υ⥸塼ϡ³ (connection tracking) Ȥ߹碌Ѥȡ
ѥåȤˤĤƤ³׾֤Τ뤳ȤǤ롣
.TP
.BI "--state " "state"
state ϡޥå󥰤ԤΡޤǶڤ줿³֤ΥꥹȤǤ롣
ǽ state ϰʲ̤ꡣ
.BR INVALID :
ΥѥåȤϴΤ³ȴطƤʤ
.BR ESTABLISHED :
ΥѥåȤϡ˥ѥåȤꤵ줿³°ѥåȤǤ롣
.BR NEW :
ΥѥåȤ³򳫻Ϥ
ˤϥѥåȤꤵƤʤ³°ѥåȤǤ롣
.BR RELATED :
ΥѥåȤ³򳫻ϤƤ뤬
FTP ǡž ICMP 顼Τ褦ˡ¸³˴طƤ롣
.SS tcp
γĥ `--protocol tcp' ꤵ˥ɤ졢
ʲΥץ󶡤:
.TP
.BR "--source-port " "[!] \fIport\fP[:\fIport\fP]"
ݡȤޤϥݡϰϤλꡣ
ӥ̾ޤϥݡֹǤ롣
.IR port : port
Ȥǡ2 ĤֹޤϰϤꤹ뤳ȤǤ롣
ǽΥݡȤά硢"0" ꤹ롣
ǸΥݡȤά硢"65535" ꤹ롣
ǽΥݡȤǸΥݡȤ礭硢2 Ĥ촹롣
.\"tsekine ʸְäƤ
ե饰
.B --sport
ϡΥץ̾Ǥ롣
.TP
.BR "--destination-port " "[!] \fIport\fP[:\fIport\fP]"
ݡȤޤϥݡϰϤλꡣ
ե饰
.B --dport
ϡΥץ̾Ǥ롣
.TP
.BR "--tcp-flags " "[!] \fImask\fP \fIcomp\fP"
TCP ե饰ꤵ줿Τ˥ޥå롣
 1 ɾоݤȤե饰ǡ޶ڤΥꥹȤǤ롣
 2 ϤΤꤵƤʤФʤʤե饰ǡ
޶ڤΥꥹȤǤ롣
Ǥե饰
.B "SYN ACK FIN RST URG PSH ALL NONE"
Ǥ롣
äơޥ
.nf
 iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST SYN
.fi
ϡSYN ե饰ꤵ ACK, FIN, RST ե饰ꤵƤʤ
ѥåȤˤΤߥޥå롣
.TP
.B "[!] --syn"
SYN ӥåȤꤵ ACK  RST ӥåȤꥢƤ
TCP ѥåȤˤΤߥޥå롣
Τ褦ʥѥåȤ TCP ³γ׵˻Ȥ롣
㤨С륤󥿡եäƤ뤳Τ褦ʥѥåȤ֥åС
¦ؤ TCP ³϶ػߤ뤬¦ؤ TCP ³ˤϱƶʤ
 \fB--tcp-flags SYN,RST,ACK SYN\fP 
"--syn"  "!" ե饰֤ȡ
SYN ӥåȤꥢ ACK  RST ӥåȤꤵƤ
TCP ѥåȤˤΤߥޥå롣
.TP
.BR "--tcp-option " "[!] \fInumber\fP"
TCP ץꤵƤ˥ޥå롣
.TP
.BR "--mss " "\fIvalue\fP[:\fIvalue\fP]"
ꤵ줿 MSS  (ϰ)  TCP  
SYN ޤ SYN/ACK ѥåȤ˥ޥå롣
MSS ³ФѥåȤκ祵椹롣
.SS tos
Υ⥸塼 IP إå 8 ӥåȤ (Ĥޤ̥ӥåȤޤ)
Type of Service եɤ˥ޥå롣
.TP
.BI "--tos " "tos"
ϡޥåԤɸŪ̾ǤͤǤ褤
(̾ΥꥹȤ򸫤ˤ
.nf
 iptables -m tos -h
.fi
Ȥ)
.SS ttl
Υ⥸塼 IP إå time to live եɤ˥ޥå롣
.TP
.BI "--ttl " "ttl"
ꤵ줿 TTL ͤ˥ޥå롣
.SS udp
γĥ `--protocol udp' ꤵ줿˥ɤ졢
ʲΥץ󶡤:
.TP
.BR "--source-port " "[!] \fIport\fP[:\fIport\fP]"
ݡȤޤϥݡϰϤλꡣ
ܺ٤ TCP ĥ
.B --source-port
ץ򻲾Ȥ뤳ȡ
.TP
.BR "--destination-port " "[!] \fIport\fP[:\fIport\fP]"
ݡȤޤϥݡϰϤλꡣ
ܺ٤ TCP ĥ
.B --destination-port
ץ򻲾Ȥ뤳ȡ
.SS unclean
Υ⥸塼ˤϥץ󤬤ʤ
Ǥʤ褦˸ѥåȤ˥ޥå롣
ϼ¸ŪʤΤȤưƤ롣
.SH åȤγĥ
iptables ϳĥåȥ⥸塼ȤȤǤ:
ʲΤΤɸŪʥǥȥӥ塼˴ޤޤƤ롣
.SS DNAT
ΥåȤ
.B nat
ơ֥
.BR PREROUTING ,
.B OUTPUT
󡢤Υ󤫤ƤӽФ
桼ΤߤͭǤ롣
ΥåȤϥѥåȤ襢ɥ쥹
(³ΰʹߤΥѥåȤ⽤ʬʤ (mangle) )
ˡ롼ˤåߤᤵ롣
ΥåȤˤϥץ 1 ढ:
.TP
.BR "--to-destination " "\fIipaddr\fP[-\fIipaddr\fP][:\fIport\fP-\fIport\fP]"
1 Ĥο IP ɥ쥹ޤ IP ɥ쥹ϰϤǤ롣
ݡȤϰϤꤹ뤳ȤǤ
(ϥ롼
.B "-p tcp"
ޤ
.B "-p udp"
ꤷƤˤΤͭ)
ݡȤϰϤꤵƤʤ硢ݡȤѹʤ
.RS
.PP
ʣ --to-destination ץꤹ뤳ȤǤ롣
ɥ쥹ϰϤˤäơ
⤷ʣ --to-destination ץˤä
2 İʾ襢ɥ쥹ꤷ硢
Υɥ쥹Ȥäñʥ饦ɡӥ
(硹˽۴Ĥ) ʤ롣
.RE
.SS DSCP
ΥåȤϡIPv4 ѥåȤ TOS إåˤ
DSCP ӥåȤͤν񤭴ǽˤ롣
ϥѥåȤΤǡmangle ơ֥ǤΤ߻ѤǤ롣
.TP
.BI "--set-dscp " "value"
DSCP եɤοͤꤹ (10 ʤޤ 16 )
.TP
.BI "--set-dscp-class " "class"
DSCP եɤ DiffServ 饹ꤹ롣
.SS ECN
ΥåȤ ECN ֥åۡؤнǽˤ롣
mangle ơ֥ǤΤ߻ѤǤ롣
.TP
.BI "--ecn-tcp-remove"
TCP إåƤ ECN ӥå (: ECE/CWR ե饰) 

.B "-p tcp"
ץȤȹ碌ǤΤ߻ѤǤ롣
.SS LOG
ޥåѥåȤ򥫡ͥ˵Ͽ롣
Υץ󤬥롼Фꤵȡ
Linux ͥϥޥåѥåȤˤĤƤ
(ʬ IP إåեɤΤ褦) 餫ξ
ͥɽ
(ͥ
.I dmesg
ޤ
.IR syslogd (8)
Ǹ뤳ȤǤ)
 "λå" Ǥ롣
ʤ롼θƤϡΥ롼ؤȷ³롣
äơݤѥåȤϿС
ƱޥåȽǴ 2 ĤΥ롼Ѥ
ǽΥ롼 LOG åȤ
Υ롼 DROP (ޤ REJECT) åȤꤹ롣
.TP
.BI "--log-level " "level"
ϿΥ٥ (ͤƻꤹ뤫
(: ̾ǻꤹ) \fIsyslog.conf\fP(5) 򻲾Ȥ뤳)
.TP
.BI "--log-prefix " "prefix"
ꤷץեååդ롣
ץեå 29 ʸޤǤĹǡ
ǥå̤ΤΩġ
.TP
.B --log-tcp-sequence
TCP ֹ˵Ͽ롣
桼ɤ硢ƥδ롣
.TP
.B --log-tcp-options
TCP ѥåȥإåΥץ˵Ͽ롣
.TP
.B --log-ip-options
IP ѥåȥإåΥץ˵Ͽ롣
.SS MARK
ѥåȤ˴ϢŤ줿 netfilter  mark ͤꤹ롣
.B mangle
ơ֥ΤߤͭǤ롣
㤨Сiproute2 Ȥ߹碌ƻȤȤǤ롣
.TP
.BI "--set-mark " "mark"
.SS MASQUERADE
ΥåȤ
.B nat
ơ֥
.B POSTROUTING
ΤߤͭǤ롣
ưŪ IP (륢å) ³ξˤΤ߻Ȥ٤Ǥ롣
 IP ɥ쥹ʤСSNAT åȤȤ٤Ǥ롣
ޥ졼ǥ󥰤ϡѥåȤ륤󥿡ե
IP ɥ쥹ؤΥޥåԥ󥰤ꤹΤƱǤ뤬
󥿡եߤ³\fI˺\fRȤ̤롣
Υ륢åפǤƱ󥿡եɥ쥹ˤʤǽ㤤
(ΤᡢΩ줿³ϼ) 硢
ư
ΥåȤˤϥץ 1 Ĥ롣
.TP
.BR "--to-ports " "\fIport\fP[-\fIport\fP]"
ΥץϡѤݡȤϰϤꤷ
ǥեȤ
.B SNAT
ݡȤˡ (嵭) ͥ褵롣
롼뤬
.B "-p tcp"
ޤ
.B "-p udp"
ꤷƤˤΤͭǤ롣
.SS MIRROR
¸Ūʥǥ󥹥ȥ졼ѤΥåȤǤꡢ
IP إåեɤ촹
ѥåȤΤǤ롣

.BR INPUT ,
.BR FORWARD ,
.B PREROUTING
ȡΥ󤫤ƤӽФ
桼ͭǤ롣
롼򤹤뤿ᡢѥåȤ
ʤѥåȥե륿󥰥³סNAT 
ƻ\fBʤ\fR
.SS REDIRECT
ΥåȤϡ
.B nat
ơ֥
.B PREROUTING 
ڤ
.B OUTPUT 
󡢤Ƥ󤫤ƤӽФ
桼ǤΤͭǤ롣
ΥåȤϥѥåȤ IP ɥ쥹
ޥ󼫿Ȥ IP ɥ쥹Ѵ롣
(줿ѥåȤϡɥ쥹 127.0.0.1 ˥ޥåפ)
ΥåȤˤϥץ 1 Ĥ:
.TP
.BR "--to-ports " "\fIport\fP[-\fIport\fP]"
ΥץϻѤݡȡݡϰϡʣݡȤꤹ롣
Υץ󤬻ꤵʤ硢ݡȤѹʤ
롼뤬
.B "-p tcp"
ޤ
.B "-p udp"
ꤷƤˤΤͭǤ롣
.SS REJECT
ޥåѥåȤαȤƥ顼ѥåȤ뤿˻Ȥ롣
顼ѥåȤʤС
.B DROP
ƱǤꡢTARGET λ롼θƤλ롣
ΥåȤϡ
.BR INPUT ,
.BR FORWARD ,
.B OUTPUT
ȡΥ󤫤ƤФ
桼ͭǤ롣
ʲΥץϡ֤륨顼ѥåȤ椹롣
.TP
.BI "--reject-with " "type"
type ȤƻǽʤΤ
.nf
.B " icmp-net-unreachable"
.B " icmp-host-unreachable"
.B " icmp-port-unreachable"
.B " icmp-proto-unreachable"
.B " icmp-net-prohibited"
.B " icmp-host-prohibited or"
.B " icmp-admin-prohibited (*)"
.fi
ǤꡢŬڤ ICMP 顼å֤
.RB ( port-unreachable
ǥեȤǤ)
TCP ץȥˤΤߥޥå롼Фơץ
.B tcp-reset
ȤȤǤ롣
ΥץȤȡTCP RST ѥåȤ֤롣
Ȥ
.I ident
(113/tcp) ˤõ˻ߤΤΩġ
.I ident
ˤõϡƤ (᡼ʤ) ᡼ۥȤ
᡼뤬ˤ˵롣
.RS
.PP
(*) icmp-admin-prohibited 򥵥ݡȤʤͥǡ
icmp-admin-prohibited Ѥȡ
REJECT ǤϤʤñʤ DROP ˤʤ롣
.SS SNAT
ΥåȤ
.B nat
ơ֥
.B POSTROUTING
ΤߤͭǤ롣
ΥåȤϥѥåȤɥ쥹
(³ΰʹߤΥѥåȤ⽤ʬʤ (mangle) )
ˡ롼뤬ɾߤ褦˻ؼ롣
ΥåȤˤϥץ 1 ढ:
.TP
.BR "--to-source  " "\fIipaddr\fP[-\fIipaddr\fP][:\fIport\fP-\fIport\fP]"
1 Ĥο IP ɥ쥹ޤ IP ɥ쥹ϰϤǤ롣
ݡȤϰϤꤹ뤳ȤǤ
(롼뤬
.B "-p tcp"
ޤ
.B "-p udp"
ꤷƤˤΤͭ)
ݡȤϰϤꤵƤʤ硢
512 ̤ݡȤϡ¾ 512 ̤ΥݡȤ˥ޥåԥ󥰤롣
512  1023 ޤǤΥݡȤϡ1024 ̤ΥݡȤ˥ޥåԥ󥰤롣
ʳΥݡȤϡ1024 ʾΥݡȤ˥ޥåԥ󥰤롣
ǽǤСݡȤѴϵʤ
.RS
.PP
ʣ --to-source ץꤹ뤳ȤǤ롣
ɥ쥹ϰϤˤäơ
⤷ʣ --to-source ץˤä
2 İʾɥ쥹ꤷ硢
Υɥ쥹Ȥäñʥ饦ɡӥ
(硹˽۴Ĥ) ʤ롣
.SS TCPMSS
ΥåȤѤȡTCP  SYN ѥåȤ MSS ͤ񤭴
Υͥκ祵
(̾ϡ󥿡ե MTU  40 )
Ǥ롣

.B "-p tcp"
Ȥ߹碌ƤȤʤ
.PP
ΥåȤȺŪƬΤ줿 ISP 
ICMP Fragmentation Needed ѥåȤ֥åƤޤС
ۤ뤿˻Ѥ롣
Linux ե/롼Ǥϲ꤬ʤΤˡ
ˤ֤鲼ޥǤϰʲΤ褦礭ʥѥåȤ
ȤǤʤȤΤǤ롣
.PD 0
.RS 0.1i
.TP 0.3i
1)
֥֡饦³Υǡ餺˥ϥ󥰤
.TP
2)
û᡼ʤĹ᡼뤬ϥ󥰤
.TP
3)
ssh ʤscp ϺǽΥϥɥ˥ϥ󥰤
.RE
.PD
ˡ: ΥץͭˤʲΤ褦ʥ롼
եɲä롣
.nf
 iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \\
             -j TCPMSS --clamp-mss-to-pmtu
.fi
.TP
.BI "--set-mss " "value"
MSS ץͤꤷͤꤹ롣
.TP
.B "--clamp-mss-to-pmtu"
ưŪˡMSS ͤ (path_MTU - 40) ˶롣
.RS
.PP
ΥץϤɤ餫 1 ĤǤʤ
.RE
.SS TOS
IP إå 8 ӥåȤ Type of Service եɤꤹ뤿˻Ȥ롣
.B mangle
ơ֥ΤߤͭǤ롣
.TP
.BI "--set-tos " "tos"
TOS ֹǻꤹ뤳ȤǤ롣
ޤ
.nf
 iptables -j TOS -h
.fi
¹Ԥ롢Ѳǽ TOS ̾ΰˤ TOS ̾Ǥ롣
.SS ULOG
ΥåȤϡޥåѥåȤ
桼֤ǥϿ뵡ǽ󶡤롣
ΥåȤ롼ꤵȡ
Linux ͥϡΥѥåȤ
.I netlink
åȤѤƥޥ㥹Ȥ롣
ơ1 İʾΥ桼֥ץ
ʥޥ㥹ȥ롼פϿ򤪤ʤ
ѥåȤ롣
LOG Ʊ͡ "λå" Ǥꡢ
롼θƤϼΥ롼ؤȷ³롣
.TP
.BI "--ulog-nlgroup " "nlgroup"
ѥåȤ netlink 롼 (1-32) ꤹ롣
ǥեȤͤ 1 Ǥ롣
.TP
.BI "--ulog-prefix " "prefix"
ꤷץեååդ롣
32 ʸޤǤλǤ롣
ǥå̤ΤǤ롣
.TP
.BI "--ulog-cprange " "size"
桼֤˥ԡѥåȤΥХȿ
ͤ 0 ξ硢˴طʤѥåȤ򥳥ԡ롣
ǥեȤ 0 Ǥ롣
.TP
.BI "--ulog-qthreshold " "size"
ͥΥ塼ѥåȤο
㤨Сͤ 10 ˤ硢
ͥ 10 ĤΥѥåȤޤȤᡢ
1 Ĥ netlink ޥѡȥåȤƥ桼֤롣
(ΤΤȤθߴΤ) ǥեȤ 1 Ǥ롣
.SH ֤
ʥ顼åɸ२顼ɽ롣
ǽ硢λɤ 0 Ǥ롣
ʥޥɥ饤ѥ᡼ˤꥨ顼ȯϡ
λ 2 ֤롣
¾Υ顼ξϡλ 1 ֤롣
.SH Х
Х? ХäƲ? ;-)
ȡġsparc64 Ǥϥ󥿡ͤǤʤ
.SH IPCHAINS Ȥθߴ
.B iptables
ϡRusty Russell  ipchains ˤ褯Ƥ롣
礭ʰ㤤ϡ
.B INPUT

.B OUTPUT
줾ۥȤäƤѥåȤȡ
ۥȤФѥåȤΤߤĴ٤ʤȤǤ롣
äơ(INPUT  OUTPUT ξΥư
롼ץХåȥեå)
ƤΥѥåȤ 3 ĤΤ 1 ̤ʤ
 (ipchains Ǥ)
եɤѥåȤ 3 ĤΥƤ̤äƤ
.PP
¾礭ʰ㤤ϡ
.B -i
ϥ󥿡ե
.B -o
ǽϥ󥿡ե򻲾Ȥ뤳ȡ
ƤȤ
.B FORWARD
ѥåȤФƻǽǤ롣
.PP
NAT Τʷʬ䤵줿
ץγĥ⥸塼ȤȤ
ǥեȤΡ֥ե륿ץơ֥Ѥ硢
.B iptables 
Ͻʥѥåȥե륿Ȥʤ롣
ϡߤ줿 IP ޥ졼ǥ󥰤ȥѥåȥե륿󥰤
ȹ礻ˤ뺮ά롣
äơץ
.nf
 -j MASQ
 -M -S
 -M -L
.fi
̤ΤΤȤư롣
iptables Ǥϡ¾ˤ⤤Ĥѹ롣
.SH Ϣ
.BR iptables-save (8),
.BR iptables-restore (8),
.BR ip6tables (8),
.BR ip6tables-save (8),
.BR ip6tables-restore (8).
.P
ѥåȥե륿󥰤ˤĤƤξܺ٤ iptables λˡ
Ƥ packet-filtering-HOWTO
NAT ˤĤƾܺ٤Ƥ NAT-HOWTO
ɸŪۤˤϴޤޤʤĥξܺ٤
Ƥ netfilter-extensions-HOWTO
¤ˤĤƾܺ٤Ƥ netfilter-hacking-HOWTO
.PP
.UR http://www.netfilter.org/
.B http://www.netfilter.org/
.UE
򻲾ȤΤȡ
.SH 
Rusty Russell ϡʳ Michael Neuling ̤ iptables 񤤤
.PP
Marc Boucher  Rusty  iptables ΰŪʥѥåιͤ򴫤ơ
ipnatctl ߤᤵ
ơmangle ơ֥롦ͭԥޥå󥰡
mark ǽ񤭡ȤǻȤƤ餷ɤ񤤤
.PP
James Morris  TOS åȤ tos ޥå󥰤񤤤
.PP
Jozsef Kadlecsik  REJECT åȤ񤤤
.PP
Harald Welte  ULOG åȤȡ
TTL, DSCP, ECN ΥޥååȤ񤤤
.PP
Netfilter ϡMarc Boucher, Martin Josefsson, Jozsef Kadlecsik, 
James Morris, Harald Welte, Rusty Russell Ǥ롣
.PP
man ڡ Herve Eychenne <rv@wallfire.org> 񤤤
.\" .. and did I mention that we are incredibly cool people?
.\" .. sexy, too ..
.\" .. witty, charming, powerful ..
.\" .. and most of all, modest ..
.\" .. ơȤƤ⥯ۤȸäƤƤ⤤ʡ
.\" ..  ..
.\" .. ȤƤ⥦åȤ٤Ǥơ㡼ߥ󥰤ǡѥե ..
.\" .. ơߤʸʤ ..