3.2.20. firewall

• ipv4 filter
  • input
    • policy
    • packets (state only)
    • bytes (state only)
    • rule
      • description
      • protocol
        • not
        • VALUE (mandatory)
      • destination
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • source
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • ipv4
        • not
        • fragment (mandatory)
      • icmp-type
        • not
        • VALUE (mandatory)
      • tcp-flags
        • not
        • set
        • examined
      • conntrack
        • status
          • not
          • VALUE
        • state
          • not
          • VALUE
      • connmark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • limit
        • burst
        • rate
          • <uint32> (mandatory)
          • UNIT
      • dscp
        • not
        • VALUE (mandatory)
      • tos
        • not
        • <0x0-0xff> (mandatory)
        • mask
      • mark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • sctp-chunk-types
        • not
        • SCOPE (mandatory)
        • init
        • init-ack
        • sack
        • heartbeat
        • heartbeat-ack
        • shutdown
        • shutdown-ack
        • error
        • cookie-echo
        • cookie-ack
        • ecn-ecne
        • ecn-cwr
        • asconf
        • asconf-ack
        • forward-tsn
        • data
          • examined
          • set
        • abort
          • examined
          • set
        • shutdown-complete
          • examined
          • set
      • inbound-interface
        • not
        • <string> (mandatory)
      • action
        • STANDARD
        • chain
        • reject
        • connmark
          • set-xmark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • save-mark
            • nfmask
            • ctmask
          • restore-mark
            • nfmask
            • ctmask
        • log
          • level
          • prefix
          • additional-infos
        • mark
          • <0x0-0xffffffff> (mandatory)
          • mask
        • tcpmss
          • set-mss
          • clamp-mss-to-pmtu
      • counters (state only)
        • packets (state only)
        • bytes (state only)
  • forward
    • policy
    • packets (state only)
    • bytes (state only)
    • rule
      • description
      • protocol
        • not
        • VALUE (mandatory)
      • destination
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • source
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • ipv4
        • not
        • fragment (mandatory)
      • icmp-type
        • not
        • VALUE (mandatory)
      • tcp-flags
        • not
        • set
        • examined
      • conntrack
        • status
          • not
          • VALUE
        • state
          • not
          • VALUE
      • connmark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • limit
        • burst
        • rate
          • <uint32> (mandatory)
          • UNIT
      • dscp
        • not
        • VALUE (mandatory)
      • tos
        • not
        • <0x0-0xff> (mandatory)
        • mask
      • mark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • sctp-chunk-types
        • not
        • SCOPE (mandatory)
        • init
        • init-ack
        • sack
        • heartbeat
        • heartbeat-ack
        • shutdown
        • shutdown-ack
        • error
        • cookie-echo
        • cookie-ack
        • ecn-ecne
        • ecn-cwr
        • asconf
        • asconf-ack
        • forward-tsn
        • data
          • examined
          • set
        • abort
          • examined
          • set
        • shutdown-complete
          • examined
          • set
      • inbound-interface
        • not
        • <string> (mandatory)
      • outbound-interface
        • not
        • <string> (mandatory)
      • action
        • STANDARD
        • chain
        • reject
        • connmark
          • set-xmark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • save-mark
            • nfmask
            • ctmask
          • restore-mark
            • nfmask
            • ctmask
        • log
          • level
          • prefix
          • additional-infos
        • mark
          • <0x0-0xffffffff> (mandatory)
          • mask
        • tcpmss
          • set-mss
          • clamp-mss-to-pmtu
      • counters (state only)
        • packets (state only)
        • bytes (state only)
  • output
    • policy
    • packets (state only)
    • bytes (state only)
    • rule
      • description
      • protocol
        • not
        • VALUE (mandatory)
      • destination
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • source
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • ipv4
        • not
        • fragment (mandatory)
      • icmp-type
        • not
        • VALUE (mandatory)
      • tcp-flags
        • not
        • set
        • examined
      • conntrack
        • status
          • not
          • VALUE
        • state
          • not
          • VALUE
      • connmark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • limit
        • burst
        • rate
          • <uint32> (mandatory)
          • UNIT
      • dscp
        • not
        • VALUE (mandatory)
      • tos
        • not
        • <0x0-0xff> (mandatory)
        • mask
      • mark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • sctp-chunk-types
        • not
        • SCOPE (mandatory)
        • init
        • init-ack
        • sack
        • heartbeat
        • heartbeat-ack
        • shutdown
        • shutdown-ack
        • error
        • cookie-echo
        • cookie-ack
        • ecn-ecne
        • ecn-cwr
        • asconf
        • asconf-ack
        • forward-tsn
        • data
          • examined
          • set
        • abort
          • examined
          • set
        • shutdown-complete
          • examined
          • set
      • outbound-interface
        • not
        • <string> (mandatory)
      • action
        • STANDARD
        • chain
        • reject
        • connmark
          • set-xmark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • save-mark
            • nfmask
            • ctmask
          • restore-mark
            • nfmask
            • ctmask
        • log
          • level
          • prefix
          • additional-infos
        • mark
          • <0x0-0xffffffff> (mandatory)
          • mask
        • tcpmss
          • set-mss
          • clamp-mss-to-pmtu
      • counters (state only)
        • packets (state only)
        • bytes (state only)
  • chain
    • policy
    • packets (state only)
    • bytes (state only)
    • rule
      • description
      • protocol
        • not
        • VALUE (mandatory)
      • destination
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • source
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • ipv4
        • not
        • fragment (mandatory)
      • icmp-type
        • not
        • VALUE (mandatory)
      • tcp-flags
        • not
        • set
        • examined
      • conntrack
        • status
          • not
          • VALUE
        • state
          • not
          • VALUE
      • connmark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • limit
        • burst
        • rate
          • <uint32> (mandatory)
          • UNIT
      • dscp
        • not
        • VALUE (mandatory)
      • tos
        • not
        • <0x0-0xff> (mandatory)
        • mask
      • mark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • sctp-chunk-types
        • not
        • SCOPE (mandatory)
        • init
        • init-ack
        • sack
        • heartbeat
        • heartbeat-ack
        • shutdown
        • shutdown-ack
        • error
        • cookie-echo
        • cookie-ack
        • ecn-ecne
        • ecn-cwr
        • asconf
        • asconf-ack
        • forward-tsn
        • data
          • examined
          • set
        • abort
          • examined
          • set
        • shutdown-complete
          • examined
          • set
      • inbound-interface
        • not
        • <string> (mandatory)
      • outbound-interface
        • not
        • <string> (mandatory)
      • rpfilter
        • invert
      • action
        • STANDARD
        • chain
        • dscp
        • reject
        • connmark
          • set-xmark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • save-mark
            • nfmask
            • ctmask
          • restore-mark
            • nfmask
            • ctmask
        • log
          • level
          • prefix
          • additional-infos
        • mark
          • <0x0-0xffffffff> (mandatory)
          • mask
        • tcpmss
          • set-mss
          • clamp-mss-to-pmtu
        • tos
          • <0x0-0xff> (mandatory)
          • mask
      • counters (state only)
        • packets (state only)
        • bytes (state only)
• ipv4 mangle
  • prerouting
    • policy
    • packets (state only)
    • bytes (state only)
    • rule
      • description
      • protocol
        • not
        • VALUE (mandatory)
      • destination
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • source
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • ipv4
        • not
        • fragment (mandatory)
      • icmp-type
        • not
        • VALUE (mandatory)
      • tcp-flags
        • not
        • set
        • examined
      • conntrack
        • status
          • not
          • VALUE
        • state
          • not
          • VALUE
      • connmark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • limit
        • burst
        • rate
          • <uint32> (mandatory)
          • UNIT
      • dscp
        • not
        • VALUE (mandatory)
      • tos
        • not
        • <0x0-0xff> (mandatory)
        • mask
      • mark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • sctp-chunk-types
        • not
        • SCOPE (mandatory)
        • init
        • init-ack
        • sack
        • heartbeat
        • heartbeat-ack
        • shutdown
        • shutdown-ack
        • error
        • cookie-echo
        • cookie-ack
        • ecn-ecne
        • ecn-cwr
        • asconf
        • asconf-ack
        • forward-tsn
        • data
          • examined
          • set
        • abort
          • examined
          • set
        • shutdown-complete
          • examined
          • set
      • inbound-interface
        • not
        • <string> (mandatory)
      • rpfilter
        • invert
      • action
        • STANDARD
        • chain
        • dscp
        • connmark
          • set-xmark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • save-mark
            • nfmask
            • ctmask
          • restore-mark
            • nfmask
            • ctmask
        • log
          • level
          • prefix
          • additional-infos
        • mark
          • <0x0-0xffffffff> (mandatory)
          • mask
        • tcpmss
          • set-mss
          • clamp-mss-to-pmtu
        • tos
          • <0x0-0xff> (mandatory)
          • mask
      • counters (state only)
        • packets (state only)
        • bytes (state only)
  • input
    • policy
    • packets (state only)
    • bytes (state only)
    • rule
      • description
      • protocol
        • not
        • VALUE (mandatory)
      • destination
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • source
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • ipv4
        • not
        • fragment (mandatory)
      • icmp-type
        • not
        • VALUE (mandatory)
      • tcp-flags
        • not
        • set
        • examined
      • conntrack
        • status
          • not
          • VALUE
        • state
          • not
          • VALUE
      • connmark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • limit
        • burst
        • rate
          • <uint32> (mandatory)
          • UNIT
      • dscp
        • not
        • VALUE (mandatory)
      • tos
        • not
        • <0x0-0xff> (mandatory)
        • mask
      • mark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • sctp-chunk-types
        • not
        • SCOPE (mandatory)
        • init
        • init-ack
        • sack
        • heartbeat
        • heartbeat-ack
        • shutdown
        • shutdown-ack
        • error
        • cookie-echo
        • cookie-ack
        • ecn-ecne
        • ecn-cwr
        • asconf
        • asconf-ack
        • forward-tsn
        • data
          • examined
          • set
        • abort
          • examined
          • set
        • shutdown-complete
          • examined
          • set
      • inbound-interface
        • not
        • <string> (mandatory)
      • action
        • STANDARD
        • chain
        • dscp
        • connmark
          • set-xmark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • save-mark
            • nfmask
            • ctmask
          • restore-mark
            • nfmask
            • ctmask
        • log
          • level
          • prefix
          • additional-infos
        • mark
          • <0x0-0xffffffff> (mandatory)
          • mask
        • tcpmss
          • set-mss
          • clamp-mss-to-pmtu
        • tos
          • <0x0-0xff> (mandatory)
          • mask
      • counters (state only)
        • packets (state only)
        • bytes (state only)
  • forward
    • policy
    • packets (state only)
    • bytes (state only)
    • rule
      • description
      • protocol
        • not
        • VALUE (mandatory)
      • destination
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • source
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • ipv4
        • not
        • fragment (mandatory)
      • icmp-type
        • not
        • VALUE (mandatory)
      • tcp-flags
        • not
        • set
        • examined
      • conntrack
        • status
          • not
          • VALUE
        • state
          • not
          • VALUE
      • connmark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • limit
        • burst
        • rate
          • <uint32> (mandatory)
          • UNIT
      • dscp
        • not
        • VALUE (mandatory)
      • tos
        • not
        • <0x0-0xff> (mandatory)
        • mask
      • mark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • sctp-chunk-types
        • not
        • SCOPE (mandatory)
        • init
        • init-ack
        • sack
        • heartbeat
        • heartbeat-ack
        • shutdown
        • shutdown-ack
        • error
        • cookie-echo
        • cookie-ack
        • ecn-ecne
        • ecn-cwr
        • asconf
        • asconf-ack
        • forward-tsn
        • data
          • examined
          • set
        • abort
          • examined
          • set
        • shutdown-complete
          • examined
          • set
      • inbound-interface
        • not
        • <string> (mandatory)
      • outbound-interface
        • not
        • <string> (mandatory)
      • action
        • STANDARD
        • chain
        • dscp
        • connmark
          • set-xmark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • save-mark
            • nfmask
            • ctmask
          • restore-mark
            • nfmask
            • ctmask
        • log
          • level
          • prefix
          • additional-infos
        • mark
          • <0x0-0xffffffff> (mandatory)
          • mask
        • tcpmss
          • set-mss
          • clamp-mss-to-pmtu
        • tos
          • <0x0-0xff> (mandatory)
          • mask
      • counters (state only)
        • packets (state only)
        • bytes (state only)
  • output
    • policy
    • packets (state only)
    • bytes (state only)
    • rule
      • description
      • protocol
        • not
        • VALUE (mandatory)
      • destination
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • source
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • ipv4
        • not
        • fragment (mandatory)
      • icmp-type
        • not
        • VALUE (mandatory)
      • tcp-flags
        • not
        • set
        • examined
      • conntrack
        • status
          • not
          • VALUE
        • state
          • not
          • VALUE
      • connmark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • limit
        • burst
        • rate
          • <uint32> (mandatory)
          • UNIT
      • dscp
        • not
        • VALUE (mandatory)
      • tos
        • not
        • <0x0-0xff> (mandatory)
        • mask
      • mark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • sctp-chunk-types
        • not
        • SCOPE (mandatory)
        • init
        • init-ack
        • sack
        • heartbeat
        • heartbeat-ack
        • shutdown
        • shutdown-ack
        • error
        • cookie-echo
        • cookie-ack
        • ecn-ecne
        • ecn-cwr
        • asconf
        • asconf-ack
        • forward-tsn
        • data
          • examined
          • set
        • abort
          • examined
          • set
        • shutdown-complete
          • examined
          • set
      • outbound-interface
        • not
        • <string> (mandatory)
      • action
        • STANDARD
        • chain
        • dscp
        • connmark
          • set-xmark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • save-mark
            • nfmask
            • ctmask
          • restore-mark
            • nfmask
            • ctmask
        • log
          • level
          • prefix
          • additional-infos
        • mark
          • <0x0-0xffffffff> (mandatory)
          • mask
        • tcpmss
          • set-mss
          • clamp-mss-to-pmtu
        • tos
          • <0x0-0xff> (mandatory)
          • mask
      • counters (state only)
        • packets (state only)
        • bytes (state only)
  • postrouting
    • policy
    • packets (state only)
    • bytes (state only)
    • rule
      • description
      • protocol
        • not
        • VALUE (mandatory)
      • destination
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • source
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • ipv4
        • not
        • fragment (mandatory)
      • icmp-type
        • not
        • VALUE (mandatory)
      • tcp-flags
        • not
        • set
        • examined
      • conntrack
        • status
          • not
          • VALUE
        • state
          • not
          • VALUE
      • connmark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • limit
        • burst
        • rate
          • <uint32> (mandatory)
          • UNIT
      • dscp
        • not
        • VALUE (mandatory)
      • tos
        • not
        • <0x0-0xff> (mandatory)
        • mask
      • mark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • sctp-chunk-types
        • not
        • SCOPE (mandatory)
        • init
        • init-ack
        • sack
        • heartbeat
        • heartbeat-ack
        • shutdown
        • shutdown-ack
        • error
        • cookie-echo
        • cookie-ack
        • ecn-ecne
        • ecn-cwr
        • asconf
        • asconf-ack
        • forward-tsn
        • data
          • examined
          • set
        • abort
          • examined
          • set
        • shutdown-complete
          • examined
          • set
      • outbound-interface
        • not
        • <string> (mandatory)
      • action
        • STANDARD
        • chain
        • dscp
        • connmark
          • set-xmark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • save-mark
            • nfmask
            • ctmask
          • restore-mark
            • nfmask
            • ctmask
        • log
          • level
          • prefix
          • additional-infos
        • mark
          • <0x0-0xffffffff> (mandatory)
          • mask
        • tcpmss
          • set-mss
          • clamp-mss-to-pmtu
        • tos
          • <0x0-0xff> (mandatory)
          • mask
      • counters (state only)
        • packets (state only)
        • bytes (state only)
  • chain
    • policy
    • packets (state only)
    • bytes (state only)
    • rule
      • description
      • protocol
        • not
        • VALUE (mandatory)
      • destination
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • source
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • ipv4
        • not
        • fragment (mandatory)
      • icmp-type
        • not
        • VALUE (mandatory)
      • tcp-flags
        • not
        • set
        • examined
      • conntrack
        • status
          • not
          • VALUE
        • state
          • not
          • VALUE
      • connmark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • limit
        • burst
        • rate
          • <uint32> (mandatory)
          • UNIT
      • dscp
        • not
        • VALUE (mandatory)
      • tos
        • not
        • <0x0-0xff> (mandatory)
        • mask
      • mark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • sctp-chunk-types
        • not
        • SCOPE (mandatory)
        • init
        • init-ack
        • sack
        • heartbeat
        • heartbeat-ack
        • shutdown
        • shutdown-ack
        • error
        • cookie-echo
        • cookie-ack
        • ecn-ecne
        • ecn-cwr
        • asconf
        • asconf-ack
        • forward-tsn
        • data
          • examined
          • set
        • abort
          • examined
          • set
        • shutdown-complete
          • examined
          • set
      • inbound-interface
        • not
        • <string> (mandatory)
      • outbound-interface
        • not
        • <string> (mandatory)
      • rpfilter
        • invert
      • action
        • STANDARD
        • chain
        • dscp
        • reject
        • connmark
          • set-xmark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • save-mark
            • nfmask
            • ctmask
          • restore-mark
            • nfmask
            • ctmask
        • log
          • level
          • prefix
          • additional-infos
        • mark
          • <0x0-0xffffffff> (mandatory)
          • mask
        • tcpmss
          • set-mss
          • clamp-mss-to-pmtu
        • tos
          • <0x0-0xff> (mandatory)
          • mask
      • counters (state only)
        • packets (state only)
        • bytes (state only)
• ipv4 raw
  • prerouting
    • policy
    • packets (state only)
    • bytes (state only)
    • rule
      • description
      • protocol
        • not
        • VALUE (mandatory)
      • destination
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • source
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • ipv4
        • not
        • fragment (mandatory)
      • icmp-type
        • not
        • VALUE (mandatory)
      • tcp-flags
        • not
        • set
        • examined
      • conntrack
        • status
          • not
          • VALUE
        • state
          • not
          • VALUE
      • connmark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • limit
        • burst
        • rate
          • <uint32> (mandatory)
          • UNIT
      • dscp
        • not
        • VALUE (mandatory)
      • tos
        • not
        • <0x0-0xff> (mandatory)
        • mask
      • mark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • sctp-chunk-types
        • not
        • SCOPE (mandatory)
        • init
        • init-ack
        • sack
        • heartbeat
        • heartbeat-ack
        • shutdown
        • shutdown-ack
        • error
        • cookie-echo
        • cookie-ack
        • ecn-ecne
        • ecn-cwr
        • asconf
        • asconf-ack
        • forward-tsn
        • data
          • examined
          • set
        • abort
          • examined
          • set
        • shutdown-complete
          • examined
          • set
      • inbound-interface
        • not
        • <string> (mandatory)
      • rpfilter
        • invert
      • action
        • STANDARD
        • chain
        • notrack
        • connmark
          • set-xmark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • save-mark
            • nfmask
            • ctmask
          • restore-mark
            • nfmask
            • ctmask
        • log
          • level
          • prefix
          • additional-infos
        • mark
          • <0x0-0xffffffff> (mandatory)
          • mask
        • tcpmss
          • set-mss
          • clamp-mss-to-pmtu
      • counters (state only)
        • packets (state only)
        • bytes (state only)
  • output
    • policy
    • packets (state only)
    • bytes (state only)
    • rule
      • description
      • protocol
        • not
        • VALUE (mandatory)
      • destination
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • source
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • ipv4
        • not
        • fragment (mandatory)
      • icmp-type
        • not
        • VALUE (mandatory)
      • tcp-flags
        • not
        • set
        • examined
      • conntrack
        • status
          • not
          • VALUE
        • state
          • not
          • VALUE
      • connmark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • limit
        • burst
        • rate
          • <uint32> (mandatory)
          • UNIT
      • dscp
        • not
        • VALUE (mandatory)
      • tos
        • not
        • <0x0-0xff> (mandatory)
        • mask
      • mark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • sctp-chunk-types
        • not
        • SCOPE (mandatory)
        • init
        • init-ack
        • sack
        • heartbeat
        • heartbeat-ack
        • shutdown
        • shutdown-ack
        • error
        • cookie-echo
        • cookie-ack
        • ecn-ecne
        • ecn-cwr
        • asconf
        • asconf-ack
        • forward-tsn
        • data
          • examined
          • set
        • abort
          • examined
          • set
        • shutdown-complete
          • examined
          • set
      • outbound-interface
        • not
        • <string> (mandatory)
      • action
        • STANDARD
        • chain
        • notrack
        • connmark
          • set-xmark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • save-mark
            • nfmask
            • ctmask
          • restore-mark
            • nfmask
            • ctmask
        • log
          • level
          • prefix
          • additional-infos
        • mark
          • <0x0-0xffffffff> (mandatory)
          • mask
        • tcpmss
          • set-mss
          • clamp-mss-to-pmtu
      • counters (state only)
        • packets (state only)
        • bytes (state only)
  • chain
    • policy
    • packets (state only)
    • bytes (state only)
    • rule
      • description
      • protocol
        • not
        • VALUE (mandatory)
      • destination
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • source
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • ipv4
        • not
        • fragment (mandatory)
      • icmp-type
        • not
        • VALUE (mandatory)
      • tcp-flags
        • not
        • set
        • examined
      • conntrack
        • status
          • not
          • VALUE
        • state
          • not
          • VALUE
      • connmark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • limit
        • burst
        • rate
          • <uint32> (mandatory)
          • UNIT
      • dscp
        • not
        • VALUE (mandatory)
      • tos
        • not
        • <0x0-0xff> (mandatory)
        • mask
      • mark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • sctp-chunk-types
        • not
        • SCOPE (mandatory)
        • init
        • init-ack
        • sack
        • heartbeat
        • heartbeat-ack
        • shutdown
        • shutdown-ack
        • error
        • cookie-echo
        • cookie-ack
        • ecn-ecne
        • ecn-cwr
        • asconf
        • asconf-ack
        • forward-tsn
        • data
          • examined
          • set
        • abort
          • examined
          • set
        • shutdown-complete
          • examined
          • set
      • inbound-interface
        • not
        • <string> (mandatory)
      • outbound-interface
        • not
        • <string> (mandatory)
      • rpfilter
        • invert
      • action
        • STANDARD
        • chain
        • dscp
        • reject
        • connmark
          • set-xmark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • save-mark
            • nfmask
            • ctmask
          • restore-mark
            • nfmask
            • ctmask
        • log
          • level
          • prefix
          • additional-infos
        • mark
          • <0x0-0xffffffff> (mandatory)
          • mask
        • tcpmss
          • set-mss
          • clamp-mss-to-pmtu
        • tos
          • <0x0-0xff> (mandatory)
          • mask
      • counters (state only)
        • packets (state only)
        • bytes (state only)
• ipv4 address group
  • address
• ipv4 network group
  • network
• ipv6 filter
  • input
    • policy
    • packets (state only)
    • bytes (state only)
    • rule
      • description
      • protocol
        • not
        • VALUE (mandatory)
      • destination
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • source
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • icmpv6-type
        • not
        • VALUE (mandatory)
      • tcp-flags
        • not
        • set
        • examined
      • conntrack
        • status
          • not
          • VALUE
        • state
          • not
          • VALUE
      • connmark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • limit
        • burst
        • rate
          • <uint32> (mandatory)
          • UNIT
      • dscp
        • not
        • VALUE (mandatory)
      • tos
        • not
        • <0x0-0xff> (mandatory)
        • mask
      • mark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • sctp-chunk-types
        • not
        • SCOPE (mandatory)
        • init
        • init-ack
        • sack
        • heartbeat
        • heartbeat-ack
        • shutdown
        • shutdown-ack
        • error
        • cookie-echo
        • cookie-ack
        • ecn-ecne
        • ecn-cwr
        • asconf
        • asconf-ack
        • forward-tsn
        • data
          • examined
          • set
        • abort
          • examined
          • set
        • shutdown-complete
          • examined
          • set
      • inbound-interface
        • not
        • <string> (mandatory)
      • action
        • STANDARD
        • chain
        • reject
        • connmark
          • set-xmark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • save-mark
            • nfmask
            • ctmask
          • restore-mark
            • nfmask
            • ctmask
        • log
          • level
          • prefix
          • additional-infos
        • mark
          • <0x0-0xffffffff> (mandatory)
          • mask
        • tcpmss
          • set-mss
          • clamp-mss-to-pmtu
      • counters (state only)
        • packets (state only)
        • bytes (state only)
  • forward
    • policy
    • packets (state only)
    • bytes (state only)
    • rule
      • description
      • protocol
        • not
        • VALUE (mandatory)
      • destination
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • source
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • icmpv6-type
        • not
        • VALUE (mandatory)
      • tcp-flags
        • not
        • set
        • examined
      • conntrack
        • status
          • not
          • VALUE
        • state
          • not
          • VALUE
      • connmark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • limit
        • burst
        • rate
          • <uint32> (mandatory)
          • UNIT
      • dscp
        • not
        • VALUE (mandatory)
      • tos
        • not
        • <0x0-0xff> (mandatory)
        • mask
      • mark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • sctp-chunk-types
        • not
        • SCOPE (mandatory)
        • init
        • init-ack
        • sack
        • heartbeat
        • heartbeat-ack
        • shutdown
        • shutdown-ack
        • error
        • cookie-echo
        • cookie-ack
        • ecn-ecne
        • ecn-cwr
        • asconf
        • asconf-ack
        • forward-tsn
        • data
          • examined
          • set
        • abort
          • examined
          • set
        • shutdown-complete
          • examined
          • set
      • inbound-interface
        • not
        • <string> (mandatory)
      • outbound-interface
        • not
        • <string> (mandatory)
      • action
        • STANDARD
        • chain
        • reject
        • connmark
          • set-xmark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • save-mark
            • nfmask
            • ctmask
          • restore-mark
            • nfmask
            • ctmask
        • log
          • level
          • prefix
          • additional-infos
        • mark
          • <0x0-0xffffffff> (mandatory)
          • mask
        • tcpmss
          • set-mss
          • clamp-mss-to-pmtu
      • counters (state only)
        • packets (state only)
        • bytes (state only)
  • output
    • policy
    • packets (state only)
    • bytes (state only)
    • rule
      • description
      • protocol
        • not
        • VALUE (mandatory)
      • destination
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • source
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • icmpv6-type
        • not
        • VALUE (mandatory)
      • tcp-flags
        • not
        • set
        • examined
      • conntrack
        • status
          • not
          • VALUE
        • state
          • not
          • VALUE
      • connmark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • limit
        • burst
        • rate
          • <uint32> (mandatory)
          • UNIT
      • dscp
        • not
        • VALUE (mandatory)
      • tos
        • not
        • <0x0-0xff> (mandatory)
        • mask
      • mark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • sctp-chunk-types
        • not
        • SCOPE (mandatory)
        • init
        • init-ack
        • sack
        • heartbeat
        • heartbeat-ack
        • shutdown
        • shutdown-ack
        • error
        • cookie-echo
        • cookie-ack
        • ecn-ecne
        • ecn-cwr
        • asconf
        • asconf-ack
        • forward-tsn
        • data
          • examined
          • set
        • abort
          • examined
          • set
        • shutdown-complete
          • examined
          • set
      • outbound-interface
        • not
        • <string> (mandatory)
      • action
        • STANDARD
        • chain
        • reject
        • connmark
          • set-xmark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • save-mark
            • nfmask
            • ctmask
          • restore-mark
            • nfmask
            • ctmask
        • log
          • level
          • prefix
          • additional-infos
        • mark
          • <0x0-0xffffffff> (mandatory)
          • mask
        • tcpmss
          • set-mss
          • clamp-mss-to-pmtu
      • counters (state only)
        • packets (state only)
        • bytes (state only)
  • chain
    • policy
    • packets (state only)
    • bytes (state only)
    • rule
      • description
      • protocol
        • not
        • VALUE (mandatory)
      • destination
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • source
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • icmpv6-type
        • not
        • VALUE (mandatory)
      • tcp-flags
        • not
        • set
        • examined
      • conntrack
        • status
          • not
          • VALUE
        • state
          • not
          • VALUE
      • connmark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • limit
        • burst
        • rate
          • <uint32> (mandatory)
          • UNIT
      • dscp
        • not
        • VALUE (mandatory)
      • tos
        • not
        • <0x0-0xff> (mandatory)
        • mask
      • mark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • sctp-chunk-types
        • not
        • SCOPE (mandatory)
        • init
        • init-ack
        • sack
        • heartbeat
        • heartbeat-ack
        • shutdown
        • shutdown-ack
        • error
        • cookie-echo
        • cookie-ack
        • ecn-ecne
        • ecn-cwr
        • asconf
        • asconf-ack
        • forward-tsn
        • data
          • examined
          • set
        • abort
          • examined
          • set
        • shutdown-complete
          • examined
          • set
      • inbound-interface
        • not
        • <string> (mandatory)
      • outbound-interface
        • not
        • <string> (mandatory)
      • rpfilter
        • invert
      • action
        • STANDARD
        • chain
        • reject
        • connmark
          • set-xmark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • save-mark
            • nfmask
            • ctmask
          • restore-mark
            • nfmask
            • ctmask
        • log
          • level
          • prefix
          • additional-infos
        • mark
          • <0x0-0xffffffff> (mandatory)
          • mask
        • tcpmss
          • set-mss
          • clamp-mss-to-pmtu
      • counters (state only)
        • packets (state only)
        • bytes (state only)
• ipv6 mangle
  • prerouting
    • policy
    • packets (state only)
    • bytes (state only)
    • rule
      • description
      • protocol
        • not
        • VALUE (mandatory)
      • destination
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • source
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • icmpv6-type
        • not
        • VALUE (mandatory)
      • tcp-flags
        • not
        • set
        • examined
      • conntrack
        • status
          • not
          • VALUE
        • state
          • not
          • VALUE
      • connmark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • limit
        • burst
        • rate
          • <uint32> (mandatory)
          • UNIT
      • dscp
        • not
        • VALUE (mandatory)
      • tos
        • not
        • <0x0-0xff> (mandatory)
        • mask
      • mark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • sctp-chunk-types
        • not
        • SCOPE (mandatory)
        • init
        • init-ack
        • sack
        • heartbeat
        • heartbeat-ack
        • shutdown
        • shutdown-ack
        • error
        • cookie-echo
        • cookie-ack
        • ecn-ecne
        • ecn-cwr
        • asconf
        • asconf-ack
        • forward-tsn
        • data
          • examined
          • set
        • abort
          • examined
          • set
        • shutdown-complete
          • examined
          • set
      • inbound-interface
        • not
        • <string> (mandatory)
      • rpfilter
        • invert
      • action
        • STANDARD
        • chain
        • connmark
          • set-xmark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • save-mark
            • nfmask
            • ctmask
          • restore-mark
            • nfmask
            • ctmask
        • log
          • level
          • prefix
          • additional-infos
        • mark
          • <0x0-0xffffffff> (mandatory)
          • mask
        • tcpmss
          • set-mss
          • clamp-mss-to-pmtu
      • counters (state only)
        • packets (state only)
        • bytes (state only)
  • input
    • policy
    • packets (state only)
    • bytes (state only)
    • rule
      • description
      • protocol
        • not
        • VALUE (mandatory)
      • destination
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • source
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • icmpv6-type
        • not
        • VALUE (mandatory)
      • tcp-flags
        • not
        • set
        • examined
      • conntrack
        • status
          • not
          • VALUE
        • state
          • not
          • VALUE
      • connmark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • limit
        • burst
        • rate
          • <uint32> (mandatory)
          • UNIT
      • dscp
        • not
        • VALUE (mandatory)
      • tos
        • not
        • <0x0-0xff> (mandatory)
        • mask
      • mark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • sctp-chunk-types
        • not
        • SCOPE (mandatory)
        • init
        • init-ack
        • sack
        • heartbeat
        • heartbeat-ack
        • shutdown
        • shutdown-ack
        • error
        • cookie-echo
        • cookie-ack
        • ecn-ecne
        • ecn-cwr
        • asconf
        • asconf-ack
        • forward-tsn
        • data
          • examined
          • set
        • abort
          • examined
          • set
        • shutdown-complete
          • examined
          • set
      • inbound-interface
        • not
        • <string> (mandatory)
      • action
        • STANDARD
        • chain
        • dscp
        • connmark
          • set-xmark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • save-mark
            • nfmask
            • ctmask
          • restore-mark
            • nfmask
            • ctmask
        • log
          • level
          • prefix
          • additional-infos
        • mark
          • <0x0-0xffffffff> (mandatory)
          • mask
        • tcpmss
          • set-mss
          • clamp-mss-to-pmtu
        • tos
          • <0x0-0xff> (mandatory)
          • mask
      • counters (state only)
        • packets (state only)
        • bytes (state only)
  • forward
    • policy
    • packets (state only)
    • bytes (state only)
    • rule
      • description
      • protocol
        • not
        • VALUE (mandatory)
      • destination
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • source
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • icmpv6-type
        • not
        • VALUE (mandatory)
      • tcp-flags
        • not
        • set
        • examined
      • conntrack
        • status
          • not
          • VALUE
        • state
          • not
          • VALUE
      • connmark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • limit
        • burst
        • rate
          • <uint32> (mandatory)
          • UNIT
      • dscp
        • not
        • VALUE (mandatory)
      • tos
        • not
        • <0x0-0xff> (mandatory)
        • mask
      • mark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • sctp-chunk-types
        • not
        • SCOPE (mandatory)
        • init
        • init-ack
        • sack
        • heartbeat
        • heartbeat-ack
        • shutdown
        • shutdown-ack
        • error
        • cookie-echo
        • cookie-ack
        • ecn-ecne
        • ecn-cwr
        • asconf
        • asconf-ack
        • forward-tsn
        • data
          • examined
          • set
        • abort
          • examined
          • set
        • shutdown-complete
          • examined
          • set
      • inbound-interface
        • not
        • <string> (mandatory)
      • outbound-interface
        • not
        • <string> (mandatory)
      • action
        • STANDARD
        • chain
        • connmark
          • set-xmark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • save-mark
            • nfmask
            • ctmask
          • restore-mark
            • nfmask
            • ctmask
        • log
          • level
          • prefix
          • additional-infos
        • mark
          • <0x0-0xffffffff> (mandatory)
          • mask
        • tcpmss
          • set-mss
          • clamp-mss-to-pmtu
      • counters (state only)
        • packets (state only)
        • bytes (state only)
  • output
    • policy
    • packets (state only)
    • bytes (state only)
    • rule
      • description
      • protocol
        • not
        • VALUE (mandatory)
      • destination
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • source
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • icmpv6-type
        • not
        • VALUE (mandatory)
      • tcp-flags
        • not
        • set
        • examined
      • conntrack
        • status
          • not
          • VALUE
        • state
          • not
          • VALUE
      • connmark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • limit
        • burst
        • rate
          • <uint32> (mandatory)
          • UNIT
      • dscp
        • not
        • VALUE (mandatory)
      • tos
        • not
        • <0x0-0xff> (mandatory)
        • mask
      • mark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • sctp-chunk-types
        • not
        • SCOPE (mandatory)
        • init
        • init-ack
        • sack
        • heartbeat
        • heartbeat-ack
        • shutdown
        • shutdown-ack
        • error
        • cookie-echo
        • cookie-ack
        • ecn-ecne
        • ecn-cwr
        • asconf
        • asconf-ack
        • forward-tsn
        • data
          • examined
          • set
        • abort
          • examined
          • set
        • shutdown-complete
          • examined
          • set
      • outbound-interface
        • not
        • <string> (mandatory)
      • action
        • STANDARD
        • chain
        • dscp
        • connmark
          • set-xmark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • save-mark
            • nfmask
            • ctmask
          • restore-mark
            • nfmask
            • ctmask
        • log
          • level
          • prefix
          • additional-infos
        • mark
          • <0x0-0xffffffff> (mandatory)
          • mask
        • tcpmss
          • set-mss
          • clamp-mss-to-pmtu
        • tos
          • <0x0-0xff> (mandatory)
          • mask
      • counters (state only)
        • packets (state only)
        • bytes (state only)
  • postrouting
    • policy
    • packets (state only)
    • bytes (state only)
    • rule
      • description
      • protocol
        • not
        • VALUE (mandatory)
      • destination
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • source
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • icmpv6-type
        • not
        • VALUE (mandatory)
      • tcp-flags
        • not
        • set
        • examined
      • conntrack
        • status
          • not
          • VALUE
        • state
          • not
          • VALUE
      • connmark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • limit
        • burst
        • rate
          • <uint32> (mandatory)
          • UNIT
      • dscp
        • not
        • VALUE (mandatory)
      • tos
        • not
        • <0x0-0xff> (mandatory)
        • mask
      • mark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • sctp-chunk-types
        • not
        • SCOPE (mandatory)
        • init
        • init-ack
        • sack
        • heartbeat
        • heartbeat-ack
        • shutdown
        • shutdown-ack
        • error
        • cookie-echo
        • cookie-ack
        • ecn-ecne
        • ecn-cwr
        • asconf
        • asconf-ack
        • forward-tsn
        • data
          • examined
          • set
        • abort
          • examined
          • set
        • shutdown-complete
          • examined
          • set
      • outbound-interface
        • not
        • <string> (mandatory)
      • action
        • STANDARD
        • chain
        • connmark
          • set-xmark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • save-mark
            • nfmask
            • ctmask
          • restore-mark
            • nfmask
            • ctmask
        • log
          • level
          • prefix
          • additional-infos
        • mark
          • <0x0-0xffffffff> (mandatory)
          • mask
        • tcpmss
          • set-mss
          • clamp-mss-to-pmtu
      • counters (state only)
        • packets (state only)
        • bytes (state only)
  • chain
    • policy
    • packets (state only)
    • bytes (state only)
    • rule
      • description
      • protocol
        • not
        • VALUE (mandatory)
      • destination
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • source
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • icmpv6-type
        • not
        • VALUE (mandatory)
      • tcp-flags
        • not
        • set
        • examined
      • conntrack
        • status
          • not
          • VALUE
        • state
          • not
          • VALUE
      • connmark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • limit
        • burst
        • rate
          • <uint32> (mandatory)
          • UNIT
      • dscp
        • not
        • VALUE (mandatory)
      • tos
        • not
        • <0x0-0xff> (mandatory)
        • mask
      • mark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • sctp-chunk-types
        • not
        • SCOPE (mandatory)
        • init
        • init-ack
        • sack
        • heartbeat
        • heartbeat-ack
        • shutdown
        • shutdown-ack
        • error
        • cookie-echo
        • cookie-ack
        • ecn-ecne
        • ecn-cwr
        • asconf
        • asconf-ack
        • forward-tsn
        • data
          • examined
          • set
        • abort
          • examined
          • set
        • shutdown-complete
          • examined
          • set
      • inbound-interface
        • not
        • <string> (mandatory)
      • outbound-interface
        • not
        • <string> (mandatory)
      • rpfilter
        • invert
      • action
        • STANDARD
        • chain
        • reject
        • connmark
          • set-xmark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • save-mark
            • nfmask
            • ctmask
          • restore-mark
            • nfmask
            • ctmask
        • log
          • level
          • prefix
          • additional-infos
        • mark
          • <0x0-0xffffffff> (mandatory)
          • mask
        • tcpmss
          • set-mss
          • clamp-mss-to-pmtu
      • counters (state only)
        • packets (state only)
        • bytes (state only)
• ipv6 raw
  • prerouting
    • policy
    • packets (state only)
    • bytes (state only)
    • rule
      • description
      • protocol
        • not
        • VALUE (mandatory)
      • destination
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • source
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • icmpv6-type
        • not
        • VALUE (mandatory)
      • tcp-flags
        • not
        • set
        • examined
      • conntrack
        • status
          • not
          • VALUE
        • state
          • not
          • VALUE
      • connmark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • limit
        • burst
        • rate
          • <uint32> (mandatory)
          • UNIT
      • dscp
        • not
        • VALUE (mandatory)
      • tos
        • not
        • <0x0-0xff> (mandatory)
        • mask
      • mark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • sctp-chunk-types
        • not
        • SCOPE (mandatory)
        • init
        • init-ack
        • sack
        • heartbeat
        • heartbeat-ack
        • shutdown
        • shutdown-ack
        • error
        • cookie-echo
        • cookie-ack
        • ecn-ecne
        • ecn-cwr
        • asconf
        • asconf-ack
        • forward-tsn
        • data
          • examined
          • set
        • abort
          • examined
          • set
        • shutdown-complete
          • examined
          • set
      • inbound-interface
        • not
        • <string> (mandatory)
      • rpfilter
        • invert
      • action
        • STANDARD
        • chain
        • notrack
        • connmark
          • set-xmark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • save-mark
            • nfmask
            • ctmask
          • restore-mark
            • nfmask
            • ctmask
        • log
          • level
          • prefix
          • additional-infos
        • mark
          • <0x0-0xffffffff> (mandatory)
          • mask
        • tcpmss
          • set-mss
          • clamp-mss-to-pmtu
      • counters (state only)
        • packets (state only)
        • bytes (state only)
  • output
    • policy
    • packets (state only)
    • bytes (state only)
    • rule
      • description
      • protocol
        • not
        • VALUE (mandatory)
      • destination
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • source
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • icmpv6-type
        • not
        • VALUE (mandatory)
      • tcp-flags
        • not
        • set
        • examined
      • conntrack
        • status
          • not
          • VALUE
        • state
          • not
          • VALUE
      • connmark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • limit
        • burst
        • rate
          • <uint32> (mandatory)
          • UNIT
      • dscp
        • not
        • VALUE (mandatory)
      • tos
        • not
        • <0x0-0xff> (mandatory)
        • mask
      • mark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • sctp-chunk-types
        • not
        • SCOPE (mandatory)
        • init
        • init-ack
        • sack
        • heartbeat
        • heartbeat-ack
        • shutdown
        • shutdown-ack
        • error
        • cookie-echo
        • cookie-ack
        • ecn-ecne
        • ecn-cwr
        • asconf
        • asconf-ack
        • forward-tsn
        • data
          • examined
          • set
        • abort
          • examined
          • set
        • shutdown-complete
          • examined
          • set
      • outbound-interface
        • not
        • <string> (mandatory)
      • action
        • STANDARD
        • chain
        • notrack
        • connmark
          • set-xmark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • save-mark
            • nfmask
            • ctmask
          • restore-mark
            • nfmask
            • ctmask
        • log
          • level
          • prefix
          • additional-infos
        • mark
          • <0x0-0xffffffff> (mandatory)
          • mask
        • tcpmss
          • set-mss
          • clamp-mss-to-pmtu
      • counters (state only)
        • packets (state only)
        • bytes (state only)
  • chain
    • policy
    • packets (state only)
    • bytes (state only)
    • rule
      • description
      • protocol
        • not
        • VALUE (mandatory)
      • destination
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • source
        • address
          • not
          • VALUE (mandatory)
        • port
          • not
          • VALUE (mandatory)
        • port-range
          • not
          • VALUE (mandatory)
        • group
          • not
          • <string> (mandatory)
      • icmpv6-type
        • not
        • VALUE (mandatory)
      • tcp-flags
        • not
        • set
        • examined
      • conntrack
        • status
          • not
          • VALUE
        • state
          • not
          • VALUE
      • connmark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • limit
        • burst
        • rate
          • <uint32> (mandatory)
          • UNIT
      • dscp
        • not
        • VALUE (mandatory)
      • tos
        • not
        • <0x0-0xff> (mandatory)
        • mask
      • mark
        • not
        • <0x0-0xffffffff> (mandatory)
        • mask
      • sctp-chunk-types
        • not
        • SCOPE (mandatory)
        • init
        • init-ack
        • sack
        • heartbeat
        • heartbeat-ack
        • shutdown
        • shutdown-ack
        • error
        • cookie-echo
        • cookie-ack
        • ecn-ecne
        • ecn-cwr
        • asconf
        • asconf-ack
        • forward-tsn
        • data
          • examined
          • set
        • abort
          • examined
          • set
        • shutdown-complete
          • examined
          • set
      • inbound-interface
        • not
        • <string> (mandatory)
      • outbound-interface
        • not
        • <string> (mandatory)
      • rpfilter
        • invert
      • action
        • STANDARD
        • chain
        • reject
        • connmark
          • set-xmark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • save-mark
            • nfmask
            • ctmask
          • restore-mark
            • nfmask
            • ctmask
        • log
          • level
          • prefix
          • additional-infos
        • mark
          • <0x0-0xffffffff> (mandatory)
          • mask
        • tcpmss
          • set-mss
          • clamp-mss-to-pmtu
      • counters (state only)
        • packets (state only)
        • bytes (state only)
• ipv6 address group
  • address
• ipv6 network group
  • network