NAME¶

arptables - administration tool for arp packet filtering

SYNOPSIS¶

arptables [-t table] -[AD] chain rule-specification [options]
arptables [-t table] -I chain [rulenum] rule-specification [options]
arptables [-t table] -R chain rulenum rule-specification [options]
arptables [-t table] -D chain rulenum [options]
arptables [-t table] -[LFZ] [chain] [options]
arptables [-t table] -N chain
arptables [-t table] -X [chain]
arptables [-t table] -P chain target [options]
arptables [-t table] -E old-chain-name new-chain-name

DESCRIPTION¶

Arptables is used to set up, maintain, and inspect the tables of ARP packet filter rules in the Linux kernel. Several different tables may be defined. Each table contains a number of built-in chains and may also contain user-defined chains.

Each chain is a list of rules which can match a set of packets. Each rule specifies what to do with a packet that matches. This is called a `target', which may be a jump to a user-defined chain in the same table.

TARGETS¶

A firewall rule specifies criteria for a packet, and a target. If the packet does not match, the next rule in the chain is the examined; if it does match, then the next rule is specified by the value of the target, which can be the name of a user-defined chain or one of the special values ACCEPT, DROP, QUEUE, or RETURN.

ACCEPT means to let the packet through. DROP means to drop the packet on the floor. QUEUE means to pass the packet to userspace (if supported by the kernel). RETURN means stop traversing this chain and resume at the next rule in the previous (calling) chain. If the end of a built-in chain is reached or a rule in a built-in chain with target RETURN is matched, the target specified by the chain policy determines the fate of the packet.

TABLES¶

There is normally one table ("filter") included in the arptable_filter module. Which tables are present at any time depends on the kernel configuration options and which modules are present.

-t, --table table

This option specifies the packet matching table which the command should operate on. If the kernel is configured with automatic module loading, an attempt will be made to load the appropriate module for that table if it is not already there.

The tables are as follows:

filter

This is the default table (if no -t option is passed). It contains the built-in chains IN (for ARP packets entering the box), OUT (for locally-generated ARP packets).

OPTIONS¶

The options that are recognized by arptables can be divided into several different groups.

EXAMPLES¶

Let's say you have a machine with two ip addresses aaaa and bbbb. Address aaaa is only for the use of machine cccc. No other machine should be allowed to connect to it. Iptables rules are configured to enforce this requirement.

# Configure iptables to NAT any attempt to use aaaa on
# outgoing packets to machines other than cccc to use
# bbbb instead
iptables -t nat -A POSTROUTING -s aaaa ! -d cccc \


    -j SNAT --to bbbb
# Ignore arp requests from machines other than cccc for
# address aaaa.
arptables -A IN ! -s cccc -d aaaa -j DROP
# Mangle any outgoing requests from address aaaa to any
# machine but cccc to use address bbbb instead.
arptables -A OUT -s aaaa ! -d cccc -j mangle \


    --mangle-ip-s bbbb

DIAGNOSTICS¶

Various error messages are printed to standard error. The exit code is 0 for correct functioning. Errors which appear to be caused by invalid or abused command line parameters cause an exit code of 2, and other errors cause an exit code of 1.

BUGS¶

The -L -v output is excessively wide.

The short option names were chosen at random.

Well... the counters are not reliable on sparc64.

SEE ALSO¶

arptables-save(8), arptables-restore(8), iptables(8), iptables-save(8), iptables-restore(8), ip6tables(8), ip6tables-save(8), ip6tables-restore(8).

See http://www.netfilter.org/.

AUTHORS¶

Jay Fenlason <fenlason@redhat.com> wrote arptables, which was based on the iptables code by Rusty Russell, in early consultation with Michael Neuling.

The iptables man page was written by Herve Eychenne <rv@wallfire.org>, Jay Fenlason <fenlason@redhat.com> adapted it for arptables.