Technical data

140
-
-da <first dest ip addr>[:<last dest ip addr>]
where <first dest ip addr> defines the first or only destination IP address and <last dest ip addr>,
if present, defines the last destination IP address in a range. If not specified, <first dest ip addr>
is assumed to be 0.0.0.0, <last dest ip addr> is assumed to be 255.255.255.255.
-dm <dest ip mask>
where <dest ip mask>, when present, defines a mask to use when comparing the <first dest ip
addr>...<last dest ip addr> with the destination IP address in the IP packet. If not specified, the
destination IP mask is set to 255.255.255.255.
-dp <first dest port>[:<last dest port>]
where <first dest port> defines the first or only destination port and <last dest port>, if present,
defines the last destination port in a range. If not specified, the <first dest port> is assumed to be
0, the <last dest port> is assumed to be 0xffff.
-b
This option indicates that this filter should be tested twice; a first time with the source filter
information matched against the source information in the IP packet and the destination filter
information matched against the destination information in the IP packet; and a second time
with the source filter information matched against the destination information in the IP packet
and the destination filter information matched against the source information in the IP packet.
-c <count of times rule used>
indicates how many IP packets have matched this filter since the router was rebooted.
-tcp syn|ack|noflag
where
syn
is the TCP SYN flag,
ack
is the TCP ACK flag, and
noflag
means there is a TCP
packet AND neither the SYN flag or the ACK flag are set. This option is ignored if the IP
packet is not a TCP packet. If not specified, the TCP SYN and TCP ACK flags are not checked
when matching the IP packet with this filter.
Note:
MORE than one
-tcp
option in an IP filter may be specified. For example, to match this
IP filter against the initiation of a TCP connection,
-tcp syn
would be used. Only IP packets
with the TCP SYN flag AND NOT the TCP ACK flag set will match this IP filter.
To match the response to initiation of a TCP connection,
-tcp syn -tcp ack
would be needed.
Only IP packets with BOTH the TCP SYN and TCP ACK flags set would match this IP filter.
port#
Ethernet interface number. Can be 0 or 1.
Examples:
eth ip filter flush input 0
This command deletes all IP filters of type Input on the Ethernet interface 0
eth ip filter append forward deny
This command will deny the forwarding of all IP traffic. This IP filter could become the "last" IP filter as a default
action.