Red Hat Summit 红帽全球峰会支持控制台（Console）开发人员开始试用联系人

此内容没有您所选择的语言版本。

18.3.4.4. Additional Match Option Modules

Additional match options are also available through modules loaded by the iptables command. To use a match option module, load the module by name using the -m option, such as -m <module-name> (replacing <module-name> with the name of the module).
A large number of modules are available by default. It is even possible to create modules that provide additional functionality.
The following is a partial list of the most commonly used modules:
  • limit module — Places limits on how many packets are matched to a particular rule. This is especially beneficial when used in conjunction with the LOG target as it can prevent a flood of matching packets from filling up the system log with repetitive messages or using up system resources. Refer to Section 18.3.5, “Target Options” for more information about the LOG target.
    The limit module enables the following options:
    • --limit — Sets the number of matches for a particular range of time, specified with a number and time modifier arranged in a <number>/<time> format. For example, using --limit 5/hour only lets a rule match 5 times in a single hour.
      If a number and time modifier are not used, the default value of 3/hour is assumed.
    • --limit-burst — Sets a limit on the number of packets able to match a rule at one time. This option should be used in conjunction with the --limit option, and it accepts a number to set the burst threshold.
      If no number is specified, only five packets are initially able to match the rule.
  • state module — Enables state matching.
    The state module enables the following options:
    • --state — match a packet with the following connection states:
      • ESTABLISHED — The matching packet is associated with other packets in an established connection.
      • INVALID — The matching packet cannot be tied to a known connection.
      • NEW — The matching packet is either creating a new connection or is part of a two-way connection not previously seen.
      • RELATED — The matching packet is starting a new connection related in some way to an existing connection.
      These connection states can be used in combination with one another by separating them with commas, such as -m state --state INVALID,NEW.
  • mac module — Enables hardware MAC address matching.
    The mac module enables the following option:
    • --mac-source — Matches a MAC address of the network interface card that sent the packet. To exclude a MAC address from a rule, place an exclamation point character (!) after the --mac-source match option.
To view other match options available through modules, refer to the iptables man page.
返回顶部
Red Hat logoGithubredditYoutubeTwitter

学习

尝试、购买和销售

社区

关于红帽文档

通过我们的产品和服务，以及可以信赖的内容，帮助红帽用户创新并实现他们的目标。 了解我们当前的更新.

让开源更具包容性

红帽致力于替换我们的代码、文档和 Web 属性中存在问题的语言。欲了解更多详情，请参阅红帽博客.

關於紅帽

我们提供强化的解决方案，使企业能够更轻松地跨平台和环境（从核心数据中心到网络边缘）工作。

Theme

© 2025 Red Hat