Specifications

Chapter 8. Command Reference 239
The Þlter type speciÞes at which point the Þlter is compared to the IP packet (see the illustration under IP Filtering,
on page 119):
input Filter is used when the packet enters the interface, before any IP address translation is
performed.
forward Filter is used, after any IP address translation, but before routing is performed.
output Filter is used after routing and IP address translation have been performed, just before the
packet is sent out an interface.
If the packet matches the Þlter, the speciÞed action is performed:
accept The packet is allowed to proceed for further processing.
drop The packet is discarded, without sending an ICMP (Internet Control Management Protocol)
error message.
reject The packet is discarded and an ICMP error message is returned to the sender.
inipsec The packet is passed to IPSec for decrypting. The filter is intended to match packets coming
from the other IPSec gateway. Although filters are the mechanism by which packets are passed
to IPSec, it is recommended that you use IKE to manage your IP Security (see IPSec (Internet
Protocol Security), on page 134).
outipsec The packet is passed to IPSec so it can be encrypted and sent to the other IPSec gateway. The
filter is intended to match packets coming from the local protected network. Although filters are
the mechanism by which packets are passed to IPSec, it is recommended that you use IKE to
manage your IP Security (see IPSec (Internet Protocol Security), on page 134).
The following parameters specify the characteristics that an IP packet must have in order to match the Þlter. A Þlter
can require any or all of these characteristics.
-p <protocol> | TCP | UDP | ICMP
The packet must have the specified protocol. If no protocol is specified, the filter matches every protocol.
-sa <first source ip addr>[:<last source ip addr>]
The packet must have a source IP address within the specified address range. If only one address is specified,
the packet must have that source IP address. If no source IP address is specified, the filter matches any
address in the range 0.0.0.0:255.255.255.255.
-sm <source ip mask>
The filter uses the specified mask when comparing the <first source ip addr>...<last source ip addr> with the
source IP address in the IP packet. If no source mask is specified, the mask used is 255.255.255.255.
-sp <ICMP type> | <first source port>[:<last source port>]
The packet must have a source port that matches the specified ICMP type or that is within the specified port
range. If only one port is specified, the packet must have that source port. If no source port is specified, the
filter matches any source port in the range 0:0xffff.
-da <first dest ip addr>[:<last dest ip addr>]
The packet must have a destination IP address within the specified address range. If only one address is
specified, the packet must have that destination IP address. If no destination IP address is specified, the filter
matches any address in the range 0.0.0.0:255.255.255.255.
-dm <dest ip mask>
The filter uses the specified mask when comparing the <first dest ip addr>...<last dest ip addr> with the
destination IP address in the IP packet. If no destination mask is specified, the mask used is 255.255.255.255.