Ebtables使用手册

SYNOPSIS

ebtables [-t table
] -[ACDI]
chain rule specification [match extensions] [watcher extensions] target

ebtables [-t table
] -P chain ACCEPT | DROP | RETURN

ebtables [-t table
] -F [chain]

ebtables [-t table
] -Z [chain]

ebtables [-t table
] -L [-Z]
[chain] [ [--Ln] | [--Lx]
] [--Lc] [--Lmac2]

ebtables [-t table
] -N chain [-P
ACCEPT | DROP | RETURN]

ebtables [-t table
] -X [chain]

ebtables [-t table
] -E old-chain-name new-chain-name

ebtables [-t table
] --init-table

ebtables [-t table
] [--atomic-file file] --atomic-commit

ebtables [-t table
] [--atomic-file file] --atomic-init

ebtables [-t table
] [--atomic-file file] --atomic-save

DESCRIPTION

ebtablesis an application program used to set up and
maintain thetables of rules (inside the Linux kernel) that inspectEthernet frames.It is analogous to theiptablesapplication,
but less complicated, due to the fact that the Ethernet protocolis much simpler than the IP protocol.

CHAINS

There are three ebtables tables with built-in chains in theLinux kernel. These tables are used to divide functionality intodifferent sets of rules. Each set of
rules is called a chain.Each chain is an ordered list of rules that can match Ethernet frames. If arule matches an Ethernet frame, then a processing specification tellswhat to do with that matching frame. The processing specification iscalled a 'target'. However,
if the frame does not match the currentrule in the chain, then the next rule in the chain is examined and so forth.The user can create new (user-defined) chains that can be used as the 'target'of a rule. User-defined chains are very useful to get better performanceover
the linear traversal of the rules and are also essential for structuringthe filtering rules into well-organized and maintainable sets of rules.

TARGETS

A firewall rule specifies criteria for an Ethernet frame and a frameprocessing specification called a target. When a frame matches a rule,then the next action
performed by the kernel is specified by the target.The target can be one of these values:ACCEPT,DROP,CONTINUE,RETURN,an
'extension' (see below) or a jump to a user-defined chain.

ACCEPTmeans to let the frame through.DROPmeans the frame has to be dropped. In theBROUTING chain however, the ACCEPTand DROP target have differentmeanings (see the info provided
for the-t option).CONTINUEmeans the next rule has to be checked. This can be handy, f.e., to know how manyframes pass a certain point in the chain, to log those frames or to apply multipletargets on a frame.RETURNmeans
stop traversing this chain and resume at the next rule in theprevious (calling) chain.For the extension targets please refer to theTARGET EXTENSIONSsection of this man page.

TABLES

As stated earlier, there are three ebtables tables in the Linuxkernel. The table names arefilter, nat and broute.Of
these three tables,the filter table is the default table that the command operates on.If you are working with the filter table, then you can drop the '-t filter'argument to the ebtables command. However, you will need to providethe -t argument for the other
two tables. Moreover, the -t argument must be thefirst argument on the ebtables command line, if used.

-t, --table

filteris the default table and contains three built-in chains:INPUT (for frames destined for the bridge itself, on the level of the MAC destination address), OUTPUT (for locally-generated or (b)routed frames)
andFORWARD (for frames being forwarded by the bridge).

natis mostly used to change the mac addresses and contains three built-in chains:PREROUTING (for altering frames as soon as they come in), OUTPUT (for altering locally generated or (b)routed frames before they
are bridged) and POSTROUTING(for altering frames as they are about to go out). A small note on the namingof chains PREROUTING and POSTROUTING: it would be more accurate to call themPREFORWARDING and POSTFORWARDING, but for all those who come
from theiptables world to ebtables it is easier to have the same names. Note that youcan change the name(-E)if you don't like the default.

brouteis used to make a brouter, it has one built-in chain:BROUTING.The targetsDROP and ACCEPThave a special meaning in the broute table (these names are used instead ofmore descriptive names
to keep the implementation generic).DROPactually means the frame has to be routed, whileACCEPTmeans the frame has to be bridged. TheBROUTINGchain is traversed very early. However, it is only traversed by frames
entering ona bridge port that is in forwarding state. Normally those frameswould be bridged, but you can decide otherwise here. Theredirecttarget is very handy here.

EBTABLES COMMAND LINE ARGUMENTS

After the initial ebtables '-t table' command line argument, the remainingarguments can be divided into several groups. These groupsare commands, miscellaneous
commands, rule specifications, match extensions,watcher extensions and target extensions.

COMMANDS

The ebtables command arguments specify the actions to perform on the tabledefined with the -t argument. If you do not use the -t argument to namea table, the
commands apply to the default filter table.Only one command may be used on the command line at a time, except whenthe commands-L and -Zare
combined, the commands-N and -Pare
combined, or when--atomic-fileis used.

-A, --appendAppend a rule to the end of the selected chain.-D, --deleteDelete the specified rule or rules from the selected chain. There are two ways touse this command. The first is by specifying an interval of rule numbersto delete (directly after-D).Syntax: start_nr[:end_nr] (use-L
--Lnto list the rules with their rule number). When end_nr is omitted, all rules startingfrom start_nr are deleted. Using negative numbers is allowed, for moredetails about using negative numbers, see the-Icommand.
The second usage is byspecifying the complete rule as it would have been specified when it was added. Onlythe first encountered rule that is the same as this specified rule, in otherwords the matching rule with the lowest (positive) rule number, is deleted.-C, --change-countersChange the counters of the specified rule or rules from the selected chain. There are two ways touse this command. The first is by specifying an interval of rule numbersto do the changes on (directly after-C).Syntax: start_nr[:end_nr]
(use-L --Lnto list the rules with their rule number). The details are the same as for the-D command. The second usage is byspecifying the complete rule as it would have been specified when it was added. Onlythe counters of
the first encountered rule that is the same as this specified rule, in otherwords the matching rule with the lowest (positive) rule number, are changed.In the first usage, the counters are specified directly after the interval specification,in the second usage
directly after-C.First the packet counter is specified, then the byte counter. If the specified counters startwith a '+', the counter values are added to the respective current counter values.If the specified counters start with a '-', the
counter values are decreased from the respectivecurrent counter values. No bounds checking is done. If the counters don't start with '+' or '-',the current counters are changed to the specified counters.-I, --insertInsert the specified rule into the selected chain at the specified rule number. If therule number is not specified, the rule is added at the head of the chain.If the current number of rules equalsN,then the specified number can bebetween-N andN+1.For
a positive numberi,it holds thati and i-N-1specify the same place in the chain where the rule should be inserted. The rule number0 specifies the place past the last rule in the chain and using this number is thereforeequivalent to
using the-Acommand.Rule numbers structly smaller than 0 can be useful when more than one rule needs to be insertedin a chain.-P, --policySet the policy for the chain to the given target. The policy can beACCEPT, DROP or RETURN.-F, --flushFlush the selected chain. If no chain is selected, then every chain will beflushed. Flushing a chain does not change the policy of thechain, however.-Z, --zeroSet the counters of the selected chain to zero. If no chain is selected, all the countersare set to zero. The-Zcommand can be used in conjunction with the -Lcommand.When both the-Zand-Lcommands
are used together in this way, the rule counters are printed on the screenbefore they are set to zero.-L, --listList all rules in the selected chain. If no chain is selected, all chainsare listed.

The following options change the output of the-Lcommand.

--Ln

Places the rule number in front of every rule. This option is incompatible with the--Lx option.

--Lc

Shows the counters at the end of each rule displayed by the-Lcommand. Both a frame counter (pcnt) and a byte counter (bcnt) are displayed.The frame counter shows how many frames have matched the specific rule, the bytecounter shows the sum
of the frame sizes of these matching frames. Using this optionin combination with the --Lx option causes the counters to be written outin the '-c <pcnt> <bcnt>' option format.

--Lx

Changes the output so that it produces a set of ebtables commands that constructthe contents of the chain, when specified.If no chain is specified, ebtables commands to construct the contents of thetable are given, including commands for creating the user-defined
chains (if any).You can use this set of commands in an ebtables boot or reloadscript. For example the output could be used at system startup.The --Lxoption is incompatible with the--Lnlisting option. Using the--Lx option
together with the --Lc option will cause the counters to be written outin the '-c <pcnt> <bcnt>' option format.

--Lmac2

Shows all MAC addresses with the same length, adding leading zeroesif necessary. The default representation omits leading zeroes in the addresses.-N, --new-chainCreate a new user-defined chain with the given name. The number ofuser-defined chains is limited only by the number of possible chain names.A user-defined chain name has a maximumlength of 31 characters. The standard policy of the user-defined chain isACCEPT.
The policy of the new chain can be initialized to a different standardtarget by using the-Pcommand together with the-Ncommand. In this case, the chain name does not have to be specified for the-Pcommand.-X, --delete-chainDelete the specified user-defined chain. There must be no remaining references (jumps)to the specified chain, otherwise ebtables will refuse to delete it. If no chain isspecified, all user-defined chains that aren't referenced will be removed.-E, --rename-chainRename the specified chain to a new name. Besides renaming a user-definedchain, you can rename a standard chain to a name that suits yourtaste. For example, if you like PREFORWARDING more than PREROUTING,then you can use the -E command to rename the PREROUTING
chain. If you dorename one of the standard ebtables chain names, please be sure to mentionthis fact should you post a question on the ebtables mailing lists.It would be wise to use the standard name in your post. Renaming a standardebtables chain in this fashion
has no effect on the structure or functioningof the ebtables kernel table.--init-tableReplace the current table data by the initial table data.--atomic-initCopy the kernel's initial data of the table to the specifiedfile. This can be used as the first action, after which rules are addedto the file. The file can be specified using the--atomic-filecommand or through theEBTABLES_ATOMIC_FILE environment
variable.--atomic-saveCopy the kernel's current data of the table to the specifiedfile. This can be used as the first action, after which rules are addedto the file. The file can be specified using the--atomic-filecommand or through theEBTABLES_ATOMIC_FILEenvironment
variable.--atomic-commitReplace the kernel table data with the data contained in the specifiedfile. This is a useful command that allows you to load all your rules of acertain table into the kernel at once, saving the kernel a lot of precioustime and allowing atomic updates of
the tables. The file which containsthe table data is constructed by using either the--atomic-initor the--atomic-savecommand to generate a starting file. After that, using the--atomic-filecommand when constructing
rules or setting theEBTABLES_ATOMIC_FILE environment variableallows you to extend the file and build the complete table beforecommitting it to the kernel. This command can be very useful in boot scriptsto populate the ebtables tables in a fast way.

MISCELLANOUS COMMANDS

-V, --versionShow the version of the ebtables userspace program.-h, --help [list of module names]Give a brief description of the command syntax. Here you can also specifynames of extensions and ebtables will try to write help about thoseextensions. E.g.ebtables -h snat log ip arp.Specifylist_extensionsto list all extensions supported
by the userspaceutility.-j, --jump targetThe target of the rule. This is one of the following values:ACCEPT,DROP,CONTINUE,RETURN,a target extension (seeTARGET EXTENSIONS)or a user-defined chain name.--atomic-file fileLet the command operate on the specifiedfile.The data of the table tooperate on will be extracted from the file and the result of the operationwill be saved back into the file. If specified, this option should comebefore the command specification.
An alternative that should be preferred,is setting theEBTABLES_ATOMIC_FILE environment variable.-M, --modprobe programWhen talking to the kernel, use thisprogramto try to automatically load missing kernel modules.--concurrentUse a file lock to support concurrent scripts updating the ebtables kernel tables.

RULE SPECIFICATIONS

The following command line arguments make up a rule specification (as used in the add and delete commands). A "!" option before the specification inverts the
test for that specification. Apart from these standard rule specifications there are some other command line arguments of interest.See both the MATCH
EXTENSIONSand theWATCHER EXTENSIONSbelow.

-p, --protocol [!] protocolThe protocol that was responsible for creating the frame. This can be ahexadecimal number, above 0x0600,a name (e.g.ARP) orLENGTH.The protocol field of the Ethernet frame can be used to denote thelength of the header (802.2/802.3
networks). When the value of that field isbelow or equals0x0600,the value equals the size of the header and shouldn't be used as aprotocol number. Instead, all frames where the protocol field is used asthe length field are assumed to be of the same
'protocol'. The protocolname used in ebtables for these frames isLENGTH.

The file/etc/ethertypescan be used to show readablecharacters instead of hexadecimal numbers for the protocols. For example,0x0800will be represented by IPV4.The use of this file is not case sensitive. See that file for more
information. The flag--protois an alias for this option.-i, --in-interface [!] nameThe interface (bridge port) via which a frame is received (this option is useful in theINPUT,FORWARD,PREROUTING andBROUTINGchains). If the interface name ends with '+', thenany interface
name that begins with this name (disregarding '+') will match.The flag--in-ifis an alias for this option.--logical-in [!] nameThe (logical) bridge interface via which a frame is received (this option is useful in theINPUT,FORWARD,PREROUTING andBROUTINGchains).If the interface name ends with '+', thenany interface
name that begins with this name (disregarding '+') will match.-o, --out-interface [!] nameThe interface (bridge port) via which a frame is going to be sent (this option is useful in theOUTPUT,FORWARDandPOSTROUTINGchains). If the interface name ends with '+', thenany interface name that begins
with this name (disregarding '+') will match.The flag--out-ifis an alias for this option.--logical-out [!] nameThe (logical) bridge interface via which a frame is going to be sent (this optionis useful in theOUTPUT,FORWARDandPOSTROUTINGchains).If the interface name ends with '+', thenany interface name that begins
with this name (disregarding '+') will match.-s, --source [!] address[/mask]The source MAC address. Both mask and address are written as 6 hexadecimalnumbers separated by colons. Alternatively one can specify Unicast,Multicast, Broadcast or BGA (Bridge Group Address):

Unicast=00:00:00:00:00:00/01:00:00:00:00:00,Multicast=01:00:00:00:00:00/01:00:00:00:00:00,Broadcast=ff:ff:ff:ff:ff:ff/ff:ff:ff:ff:ff:ff orBGA=01:80:c2:00:00:00/ff:ff:ff:ff:ff:ff.Note that a broadcastaddress will also match
the multicast specification. The flag--srcis an alias for this option.-d, --destination [!] address[/mask]The destination MAC address. See-s(above) for more details on MAC addresses. The flag--dstis an alias for this option.-c, --set-counter pcnt bcntIf used with-A or -I, then the packet and byte counters of the new rule will be set topcnt, resp. bcnt.If used with the-C or -Dcommands, only rules with a packet and byte
count equal topcnt, resp. bcnt will match.

MATCH EXTENSIONS

Ebtables extensions are dynamically loaded into the userspace tool,there is therefore no need to explicitly load them with a-m option like is done in iptables.These
extensions deal with functionality supported by kernel modules supplemental tothe core ebtables code.

802_3

Specify 802.3 DSAP/SSAP fields or SNAP type. The protocol must be specified asLENGTH (see
the option -p above).

--802_3-sap [!] sapDSAP and SSAP are two one byte 802.3 fields. The bytes are alwaysequal, so only one byte (hexadecimal) is needed as an argument.--802_3-type [!] typeIf the 802.3 DSAP and SSAP values are 0xaa then the SNAP type field mustbe consulted to determine the payload protocol. This is a two byte(hexadecimal) argument. Only 802.3 frames with DSAP/SSAP 0xaa arechecked for type.

among

Match a MAC address or MAC/IP address pair versus a list of MAC addressesand MAC/IP address pairs.A list entry has the following format:xx:xx:xx:xx:xx:xx[=ip.ip.ip.ip][,].
Multiplelist entries are separated by a comma, specifying an IP address corresponding tothe MAC address is optional. Multiple MAC/IP address pairs with the same MAC addressbut different IP address (and vice versa) can be specified. If the MAC address doesn'tmatch
any entry from the list, the frame doesn't match the rule (unless "!" was used).

--among-dst [!] listCompare the MAC destination to the given list. If the Ethernet frame has typeIPv4 or ARP,then comparison with MAC/IP destination address pairs from thelist is possible.--among-src [!] listCompare the MAC source to the given list. If the Ethernet frame has typeIPv4 or ARP,then comparison with MAC/IP source address pairs from the listis possible.--among-dst-file [!] fileSame as--among-dst but the list is read in from the specified file.--among-src-file [!] fileSame as--among-src but the list is read in from the specified file.

arp

Specify (R)ARP fields. The protocol must be specified asARP or RARP.

--arp-opcode [!] opcodeThe (R)ARP opcode (decimal or a string, for more details seeebtables -h arp).--arp-htype [!] hardware typeThe hardware type, this can be a decimal or the stringEthernet(which setstypeto 1). Most (R)ARP packets have Eternet as hardware type.--arp-ptype [!] protocol typeThe protocol type for which the (r)arp is used (hexadecimal or the stringIPv4,denoting 0x0800).Most (R)ARP packets have protocol type IPv4.--arp-ip-src [!] address[/mask]The (R)ARP IP source address specification.--arp-ip-dst [!] address[/mask]The (R)ARP IP destination address specification.--arp-mac-src [!] address[/mask]The (R)ARP MAC source address specification.--arp-mac-dst [!] address[/mask]The (R)ARP MAC destination address specification.[!] --arp-gratuitousChecks for ARP gratuitous packets: checks equality of IPv4 sourceaddress and IPv4 destination address inside the ARP header.

ip

Specify IPv4 fields. The protocol must be specified asIPv4.

--ip-source [!] address[/mask]The source IP address.The flag--ip-srcis an alias for this option.--ip-destination [!] address[/mask]The destination IP address.The flag--ip-dstis an alias for this option.--ip-tos [!] tosThe IP type of service, in hexadecimal numbers.IPv4.--ip-protocol [!] protocolThe IP protocol.The flag--ip-protois an alias for this option.--ip-source-port [!] port1[:port2]The source port or port range for the IP protocols 6 (TCP), 17(UDP), 33 (DCCP) or 132 (SCTP). The--ip-protocoloption must be specified asTCP, UDP, DCCP or SCTP.Ifport1 is omitted, 0:port2 is
used; if port2 is omitted but a colon is specified, port1:65535is used.The flag--ip-sportis an alias for this option.--ip-destination-port [!] port1[:port2]The destination port or port range for ip protocols 6 (TCP), 17(UDP), 33 (DCCP) or 132 (SCTP). The--ip-protocoloption must be specified asTCP, UDP, DCCP or SCTP.Ifport1 is omitted, 0:port2 is
used; if port2 is omitted but a colon is specified,port1:65535 is used.The flag--ip-dportis an alias for this option.

ip6

Specify IPv6 fields. The protocol must be specified asIPv6.

--ip6-source [!] address[/mask]The source IPv6 address.The flag--ip6-srcis an alias for this option.--ip6-destination [!] address[/mask]The destination IPv6 address.The flag--ip6-dstis an alias for this option.--ip6-tclass [!] tclassThe IPv6 traffic class, in hexadecimal numbers.--ip6-protocol [!] protocolThe IP protocol.The flag--ip6-protois an alias for this option.--ip6-source-port [!] port1[:port2]The source port or port range for the IPv6 protocols 6 (TCP), 17(UDP), 33 (DCCP) or 132 (SCTP). The--ip6-protocoloption must be specified asTCP, UDP, DCCP or SCTP.Ifport1 is omitted, 0:port2 is
used; if port2 is omitted but a colon is specified,port1:65535 is used.The flag--ip6-sportis an alias for this option.--ip6-destination-port [!] port1[:port2]The destination port or port range for IPv6 protocols 6 (TCP), 17(UDP), 33 (DCCP) or 132 (SCTP). The--ip6-protocoloption must be specified asTCP, UDP, DCCP or SCTP.Ifport1 is omitted, 0:port2 is
used; if port2 is omitted but a colon is specified,port1:65535 is used.The flag--ip6-dportis an alias for this option.--ip6-icmp-type [!] {type[:type]/code[:code]|typename}Specify ipv6-icmp type and code to match.Ranges for both type and code are supported. Type and code areseparated by a slash. Valid numbers for type and range are 0 to 255.To match a single type including all valid codes, symbolic names canbe used instead
of numbers. The list of known type names is shown by the command

ebtables --help ip6

This option is only valid for --ip6-prococol ipv6-icmp.

limit

This module matches at a limited rate using a token bucket filter.A rule using this extension will match until this limit is reached.It can be used with the--logwatcher
to give limited logging, for example. Its use is the sameas the limit match of iptables.

--limit [value]Maximum average matching rate: specified as a number, with an optional/second, /minute, /hour, or /day suffix; the default is3/hour.--limit-burst [number]Maximum initial number of packets to match: this number gets recharged byone every time the limit specified above is not reached, up to thisnumber; the default is5.

mark_m

--mark [!] [value][/mask]Matches frames with the given unsigned mark value. If avalue and mask are specified, the logical AND of the mark value of the frame andthe user-specifiedmask is taken before comparing it with theuser-specified markvalue.
When only a mark valueis specified, the packetonly matches when the mark value of the frame equals the user-specifiedmarkvalue.If only amask is specified, the logicalAND of the mark value of the frame and the user-specifiedmask is
taken and the frame matches when the result of this logical AND isnon-zero. Only specifying amask is useful to match multiple mark values.

pkttype

--pkttype-type [!] typeMatches on the Ethernet "class" of the frame, which is determined by thegeneric networking code. Possible values:broadcast(MAC destination is the broadcast address),multicast (MAC destination is a multicast address),host (MAC
destination is the receiving network device), or otherhost (none of the above).

stp

Specify stp BPDU (bridge protocol data unit) fields. The destinationaddress(-d)
must be specified as the bridge group address(BGA).For
all options for which a range of values can be specified, it holds thatif the lower bound is omitted (but the colon is not), then the lowest possible lower boundfor that option is used, while if the upper bound is omitted (but the colon again is not), thehighest
possible upper bound for that option is used.

--stp-type [!] typeThe BPDU type (0-255), recognized non-numerical types areconfig, denoting a configuration BPDU (=0), andtcn, denothing a topology change notification BPDU (=128).--stp-flags [!] flagThe BPDU flag (0-255), recognized non-numerical flags aretopology-change, denoting the topology change flag (=1), andtopology-change-ack, denoting the topology change acknowledgement flag (=128).--stp-root-prio [!] [prio][:prio]The root priority (0-65535) range.--stp-root-addr [!] [address][/mask]The root mac address, see the option-s for more details.--stp-root-cost [!] [cost][:cost]The root path cost (0-4294967295) range.--stp-sender-prio [!] [prio][:prio]The BPDU's sender priority (0-65535) range.--stp-sender-addr [!] [address][/mask]The BPDU's sender mac address, see the option-s for more details.--stp-port [!] [port][:port]The port identifier (0-65535) range.--stp-msg-age [!] [age][:age]The message age timer (0-65535) range.--stp-max-age [!] [age][:age]The max age timer (0-65535) range.--stp-hello-time [!] [time][:time]The hello time timer (0-65535) range.--stp-forward-delay [!] [delay][:delay]The forward delay timer (0-65535) range.

vlan

Specify 802.1Q Tag Control Information fields.The protocol must be specified as802_1Q (0x8100).

--vlan-id [!] idThe VLAN identifier field (VID). Decimal number from 0 to 4095.--vlan-prio [!] prioThe user priority field, a decimal number from 0 to 7.The VID should be set to 0 ("null VID") or unspecified(in the latter case the VID is deliberately set to 0).--vlan-encap [!] typeThe encapsulated Ethernet frame type/length.Specified as a hexadecimalnumber from 0x0000 to 0xFFFF or as a symbolic namefrom/etc/ethertypes.

WATCHER EXTENSIONS

Watchers only look at frames passing by, they don't modify them nor decideto accept the frames or not. These watchers onlysee the frame if the frame matches the
rule, and they see it before thetarget is executed.

log

The log watcher writes descriptive data about a frame to the syslog.

--log

Log with the default loggin options: log-level=info,log-prefix="", no ip logging, no arp logging.--log-level level

Defines the logging level. For the possible values, seeebtables -h log.The default level is info.--log-prefix text

Defines the prefixtextto be printed at the beginning of the line with the logging information.--log-ip

Will log the ip information when a frame made by the ip protocol matches the rule. The default is no ip information logging.--log-ip6

Will log the ipv6 information when a frame made by the ipv6 protocol matches the rule. The default is no ipv6 information logging.--log-arp

Will log the (r)arp information when a frame made by the (r)arp protocolsmatches the rule. The default is no (r)arp information logging.

nflog

The nflog watcher passes the packet to the loaded logging backendin order to log the packet. This is usually used in combination withnfnetlink_log as logging
backend, which will multicast the packetthrough anetlinksocket
to the specified multicast group. One or more userspace processesmay subscribe to the group to receive the packets.

--nflog

Log with the default logging options--nflog-group nlgroup

The netlink group (1 - 2^32-1) to which packets are (only applicable fornfnetlink_log). The default value is 1.--nflog-prefix prefix

A prefix string to include in the log message, up to 30 characterslong, useful for distinguishing messages in the logs.--nflog-range size

The number of bytes to be copied to userspace (only applicable fornfnetlink_log). nfnetlink_log instances may specify their ownrange, this option overrides it.--nflog-threshold size

Number of packets to queue inside the kernel before sending themto userspace (only applicable for nfnetlink_log). Higher valuesresult in less overhead per packet, but increase delay until thepackets reach userspace. The default value is 1.

ulog

The ulog watcher passes the packet to a userspacelogging daemon using netlink multicast sockets. This differsfrom the log watcher in the sense that the complete
packet issent to userspace instead of a descriptive text and thatnetlink multicast sockets are used instead of the syslog.This watcher enables parsing of packets with userspace programs, thephysical bridge in and out ports are also included in the netlink
messages.The ulog watcher module accepts 2 parameters when the module is loadedinto the kernel (e.g. with modprobe):nlbufsizspecifies
how big the buffer for each netlink multicastgroup is. If you saynlbufsiz=8192,for
example, up to eight kB of packets willget accumulated in the kernel until they are sent to userspace. It isnot possible to allocate more than 128kB. Please also keep in mind thatthis buffer size is allocated for each nlgroup you are using, so thetotal kernel
memory usage increases by that factor. The default is 4096.flushtimeoutspecifies
after how many hundredths of a second the queue should beflushed, even if it is not full yet. The default is 10 (one tenth ofa second).

--ulog

Use the default settings: ulog-prefix="", ulog-nlgroup=1,ulog-cprange=4096, ulog-qthreshold=1.--ulog-prefix text

Defines the prefix included with the packets sent to userspace.--ulog-nlgroup group

Defines which netlink group number to use (a number from 1 to 32).Make sure the netlink group numbers used for the iptables ULOGtarget differ from those used for the ebtables ulog watcher.The default group number is 1.--ulog-cprange range

Defines the maximum copy range to userspace, for packets matching therule. The default range is 0, which means the maximum copy range isgiven bynlbufsiz.A maximum copy range larger than128*1024 is meaningless as the packets sent to userspace
have an uppersize limit of 128*1024.--ulog-qthreshold threshold

Queue at mostthresholdnumber of packets before sending them touserspace with a netlink socket. Note that packets can be sent touserspace before the queue is full, this happens when the ulogkernel timer goes off (the frequency of this timer depends
onflushtimeout).

TARGET EXTENSIONS

arpreply

Thearpreplytarget
can be used in thePREROUTING chain of the nat table.If
this target sees an ARP request it will automatically replywith an ARP reply. The used MAC address for the reply can be specified.The protocol must be specified asARP.When
the ARP message is not an ARP request or when the ARP request isn'tfor an IP address on an Ethernet network, it is ignored by this target(CONTINUE).When
the ARP request is malformed, it is dropped(DROP).

--arpreply-mac addressSpecifies the MAC address to reply with: the Ethernet source MAC and theARP payload source MAC will be filled in with this address.--arpreply-target targetSpecifies the standard target. After sending the ARP reply, the rule stillhas to give a standard target so ebtables knows what to do with the ARP request.The default targetis DROP.

dnat

Thednattarget
can only be used in theBROUTING chain of the broute table
and the PREROUTING and OUTPUT chains
of the nattable.It specifies that the destination
MAC address has to be changed.

--to-destination address

Change the destination MAC address to the specifiedaddress.The flag--to-dstis an alias for this option.--dnat-target target

Specifies the standard target. After doing the dnat, the rule still has togive a standard target so ebtables knows what to do with the dnated frame.The default target isACCEPT.Making itCONTINUE could let you usemultiple target
extensions on the same frame. Making itDROP only makessense in theBROUTING chain but using the redirect target is more logical there.RETURN is also allowed. Note that using RETURNin
a base chain is not allowed (for obvious reasons).

mark

The mark target
can be used in every chain of every table. It is possibleto use the marking of a frame/packet in both ebtables and iptables,if the bridge-nf code is compiled into the kernel. Both put the marking at thesame place. This allows for a form of communication between
ebtables and iptables.

--mark-set value

Mark the frame with the specified non-negativevalue.--mark-or value

Or the frame with the specified non-negativevalue.--mark-and value

And the frame with the specified non-negativevalue.--mark-xor value

Xor the frame with the specified non-negativevalue.--mark-target target

Specifies the standard target. After marking the frame, the rulestill has to give a standard target so ebtables knows what to do.The default target isACCEPT. Making it CONTINUE can let you do otherthings with the frame in subsequent
rules of the chain.

redirect

Theredirecttarget
will change the MAC target address to that of the bridge device theframe arrived on. This target can only be used in theBROUTING chain
of the broute table and the PREROUTING chain
of the nat table.In theBROUTING chain,
the MAC address of the bridge port is used as destination address,in the PREROUTING chain,
the MAC address of the bridge is used.

--redirect-target target

Specifies the standard target. After doing the MAC redirect, the rulestill has to give a standard target so ebtables knows what to do.The default target isACCEPT. Making it CONTINUE could let you usemultiple target extensions
on the same frame. Making itDROP in the BROUTING chain will let the frames be routed. RETURN is also allowed. Notethat using RETURN in a base chain is not allowed.

snat

Thesnattarget
can only be used in thePOSTROUTING chain of
the nat table.It specifies that the source MAC
address has to be changed.

--to-source address

Changes the source MAC address to the specifiedaddress. The flag--to-srcis an alias for this option.--snat-target target

Specifies the standard target. After doing the snat, the rule still has to give a standard target so ebtables knows what to do.The default target is ACCEPT. Making it CONTINUE could let you usemultiple target extensions on
the same frame. Making it DROP doesn'tmake sense, but you could do that too. RETURN is also allowed. Notethat using RETURN in a base chain is not allowed.

--snat-arp

Also change the hardware source address inside the arp header if the packet is anarp message and the hardware address length in the arp header is 6 bytes.

参考文档:

http://ebtables.sourceforge.net/misc/ebtables-man.html

http://gomix.fedora-ve.org/projects/6/wiki/Ebtables

http://ebtables.sourceforge.net/br_fw_ia/br_fw_ia.html

http://ebtables.sourceforge.net/examples/basic.html#ex_config

http://wiki.debian.org/DebianFirewall

http://www.oschina.net/p/ebtables?from=rss