1These extensions can be used if `\-\-protocol tcp' is specified. It 2provides the following options: 3.TP 4[\fB!\fP] \fB\-\-source\-port\fP,\fB\-\-sport\fP \fIport\fP[\fB:\fP\fIport\fP] 5Source port or port range specification. This can either be a service 6name or a port number. An inclusive range can also be specified, 7using the format \fIfirst\fP\fB:\fP\fIlast\fP. 8If the first port is omitted, "0" is assumed; if the last is omitted, 9"65535" is assumed. 10If the first port is greater than the second one they will be swapped. 11The flag 12\fB\-\-sport\fP 13is a convenient alias for this option. 14.TP 15[\fB!\fP] \fB\-\-destination\-port\fP,\fB\-\-dport\fP \fIport\fP[\fB:\fP\fIport\fP] 16Destination port or port range specification. The flag 17\fB\-\-dport\fP 18is a convenient alias for this option. 19.TP 20[\fB!\fP] \fB\-\-tcp\-flags\fP \fImask\fP \fIcomp\fP 21Match when the TCP flags are as specified. The first argument \fImask\fP is the 22flags which we should examine, written as a comma-separated list, and 23the second argument \fIcomp\fP is a comma-separated list of flags which must be 24set. Flags are: 25.BR "SYN ACK FIN RST URG PSH ALL NONE" . 26Hence the command 27.nf 28 iptables \-A FORWARD \-p tcp \-\-tcp\-flags SYN,ACK,FIN,RST SYN 29.fi 30will only match packets with the SYN flag set, and the ACK, FIN and 31RST flags unset. 32.TP 33[\fB!\fP] \fB\-\-syn\fP 34Only match TCP packets with the SYN bit set and the ACK,RST and FIN bits 35cleared. Such packets are used to request TCP connection initiation; 36for example, blocking such packets coming in an interface will prevent 37incoming TCP connections, but outgoing TCP connections will be 38unaffected. 39It is equivalent to \fB\-\-tcp\-flags SYN,RST,ACK,FIN SYN\fP. 40If the "!" flag precedes the "\-\-syn", the sense of the 41option is inverted. 42.TP 43[\fB!\fP] \fB\-\-tcp\-option\fP \fInumber\fP 44Match if TCP option set. 45