1This modules matches the policy used by IPsec for handling a packet. 2.TP 3.BI "--dir " "in|out" 4Used to select whether to match the policy used for decapsulation or the 5policy that will be used for encapsulation. 6.B in 7is valid in the 8.B PREROUTING, INPUT and FORWARD 9chains, 10.B out 11is valid in the 12.B POSTROUTING, OUTPUT and FORWARD 13chains. 14.TP 15.BI "--pol " "none|ipsec" 16Matches if the packet is subject to IPsec processing. 17.TP 18.BI "--strict" 19Selects whether to match the exact policy or match if any rule of 20the policy matches the given policy. 21.TP 22.BI "--reqid " "id" 23Matches the reqid of the policy rule. The reqid can be specified with 24.B setkey(8) 25using 26.B unique:id 27as level. 28.TP 29.BI "--spi " "spi" 30Matches the SPI of the SA. 31.TP 32.BI "--proto " "ah|esp|ipcomp" 33Matches the encapsulation protocol. 34.TP 35.BI "--mode " "tunnel|transport" 36Matches the encapsulation mode. 37.TP 38.BI "--tunnel-src " "addr[/mask]" 39Matches the source end-point address of a tunnel mode SA. 40Only valid with --mode tunnel. 41.TP 42.BI "--tunnel-dst " "addr[/mask]" 43Matches the destination end-point address of a tunnel mode SA. 44Only valid with --mode tunnel. 45.TP 46.BI "--next" 47Start the next element in the policy specification. Can only be used with 48--strict 49