Copyright (C) 2000-2012 |
Whole document tree 6. New IPv6 netfilter matchesIn this section, we will attempt to explain the usage of new netfilter matches. The patches will appear in alphabetical order. Additionally, we will not explain patches that break other patches. But this might come later. Generally speaking, for matches, you can get the help hints from a particular module by typing :
This would display the normal ip6tables help message, plus the specific ``the_match_you_want'' match help message at the end. 6.1 agr patchThis patch by Andras Kis-Szabo <kisza@sch.bme.hu> adds 1 new match :
This patch can be quite useful for people using EUI-64 IPv6 addressing scheme who are willing to check the packets based on the delivered address on a LAN. For example, we will redirect the packets that have a correct EUI-64 address:
This match hasn't got any option. 6.2 ipv6header patchThis patch by Andras Kis-Szabo <kisza@sch.bme.hu> adds a new match that allows you to match a packet based on its extension headers. For example, let's drop the packets which have got hop-by-hop, ipv6-route headers and a protocol payload:
And now, let's drop the packets which have got an ipv6-route extension header:
Supported options for the ipv6header match are :
6.3 ipv6-ports patchThis patch by Jan Rekorajski <baggins@pld.org.pl> adds 4 new matches :
These matches are the ports of the IPv4 versions. See the main documentation for the details! 6.4 length patchThis patch by Imran Patel <ipatel@crosswinds.net> adds a new match that allows you to match a packet based on its length. (This patch is shameless adaption from the IPv4 match written by James Morris <jmorris@intercode.com.au>) For example, let's drop all the pings with a packet size greater than 85 bytes :
Supported options for the length match are :
Values of the range not present will be implied. The implied value for minimum is 0, and for maximum is 65535. Next Previous Contents |