diff options
| author | jk7744.park <jk7744.park@samsung.com> | 2015-09-08 21:56:24 +0900 |
|---|---|---|
| committer | jk7744.park <jk7744.park@samsung.com> | 2015-09-08 21:56:24 +0900 |
| commit | 427e21006a01f98c92434008442bba504c9d2e6c (patch) | |
| tree | 8d3cdcc6e535016586023d74b9816ef339ddb31f /extensions/libxt_socket.man | |
| parent | f5589e19420a83ca978348cbcfbc4c83b310bd3b (diff) | |
| download | iptables-427e21006a01f98c92434008442bba504c9d2e6c.tar.gz iptables-427e21006a01f98c92434008442bba504c9d2e6c.tar.bz2 iptables-427e21006a01f98c92434008442bba504c9d2e6c.zip | |
tizen 2.3.1 releasetizen_2.3.1_releasesubmit/tizen_2.3.1/20150915.074541tizen_2.3.1
Diffstat (limited to 'extensions/libxt_socket.man')
| -rw-r--r-- | extensions/libxt_socket.man | 24 |
1 files changed, 22 insertions, 2 deletions
diff --git a/extensions/libxt_socket.man b/extensions/libxt_socket.man index 50c8854..2ef32ce 100644 --- a/extensions/libxt_socket.man +++ b/extensions/libxt_socket.man @@ -1,2 +1,22 @@ -This matches if an open socket can be found by doing a socket lookup on the -packet. +This matches if an open TCP/UDP socket can be found by doing a socket lookup on the +packet. It matches if there is an established or non\-zero bound listening +socket (possibly with a non\-local address). The lookup is performed using +the \fBpacket\fP tuple of TCP/UDP packets, or the original TCP/UDP header +\fBembedded\fP in an ICMP/ICPMv6 error packet. +.TP +\fB\-\-transparent\fP +Ignore non-transparent sockets. +.TP +\fB\-\-nowildcard\fP +Do not ignore sockets bound to 'any' address. +The socket match won't accept zero\-bound listeners by default, since +then local services could intercept traffic that would otherwise be forwarded. +This option therefore has security implications when used to match traffic being +forwarded to redirect such packets to local machine with policy routing. +When using the socket match to implement fully transparent +proxies bound to non\-local addresses it is recommended to use the \-\-transparent +option instead. +.PP +Example (assuming packets with mark 1 are delivered locally): +.IP +\-t mangle \-A PREROUTING \-m socket \-\-transparent \-j MARK \-\-set\-mark 1 |