--append, -A -A | Append a rule to the end of the selected chain. | help + man |
--delete, -D -D | Delete the specified rule or rules from the selected chain. | help + man |
--insert, -I -I | Insert the specified rule into the selected chain at the specified rule number. | help + man |
--list, -L | -L [chain] : list the rules in a chain or in all chains | help + man |
--flush, -F | -F [chain] : delete all rules in chain or in all chains | help + man |
--init-table | Replace the current table data by the initial table data. | help + man |
--zero, -Z | -Z [chain] : put counters on zero in chain or in all chains | help + man |
--policy, -P -P | Set the policy for the chain to the given target. | help + man |
--new-chain, -N -N | Create a new user-defined chain with the given name. | help + man |
--rename-chain, -E -E | Rename the specified chain to a new name. | help + man |
--delete-chain, -X -X | Delete the specified user-defined chain. | help + man |
--modprobe, -M -M | When talking to the kernel, use this program to try to automatically load missing kernel modules. | help + man |
--concurrent | This would use a file lock to support concurrent scripts updating the ebtables kernel tables. | help + man |
--verbose, -v -v | : verbose mode | help + man |
--version, -V -V | Show the version of the ebtables userspace program. | help + man |
-C, --change-counters | Change the counters of the specified rule or rules from the selected chain. (in the manual page but not in --help) | man |
-j, --jump target | The target of the rule. (in the manual page but not in --help) | man |
-c, --set-counter pcnt | If used with -A or -I, then the packet and byte counters of the new rule will be set to pcnt, resp. (in the manual page but not in --help) | man |
--limit value | Maximum average matching rate: specified as a number, with an optional /second, /minute, /hour, or /day suffix; (in the manual page but not in --help) | man |
--log | Log with the default logging options: log-level= info, log-prefix="", no ip logging, no arp logging. (in the manual page but not in --help) | man |
--log-level level | Defines the logging level. (in the manual page but not in --help) | man |
--log-prefix text | Defines the prefix text to be printed at the beginning of the line with the logging information. (in the manual page but not in --help) | man |
--log-ip | Will log the ip information when a frame made by the ip protocol matches the rule. (in the manual page but not in --help) | man |
--log-ip6 | Will log the ipv6 information when a frame made by the ipv6 protocol matches the rule. (in the manual page but not in --help) | man |
--log-arp | Will log the (r)arp information when a frame made by the (r)arp protocols matches the rule. (in the manual page but not in --help) | man |
--nflog | Log with the default logging options (in the manual page but not in --help) | man |
--nflog-group nlgroup | The netlink group (1–2^32-1) to which packets are (only applicable for nfnetlink_log). (in the manual page but not in --help) | man |
--nflog-prefix prefix | A prefix string to include in the log message, up to 30 characters long, useful for distinguishing messages in the logs. (in the manual page but not in --help) | man |
--nflog-range size | The number of bytes to be copied to userspace (only applicable for nfnetlink_log). (in the manual page but not in --help) | man |
--nflog-threshold size | Number of packets to queue inside the kernel before sending them to userspace (only applicable for nfnetlink_log). (in the manual page but not in --help) | man |
--ulog | Use the default settings: ulog-prefix="", ulog-nlgroup=1, ulog-cprange=4096, ulog-qthreshold=1. (in the manual page but not in --help) | man |
--ulog-prefix text | Defines the prefix included with the packets sent to userspace. (in the manual page but not in --help) | man |
--ulog-nlgroup group | Defines which netlink group number to use (a number from 1 to 32). (in the manual page but not in --help) | man |
--ulog-cprange range | Defines the maximum copy range to userspace, for packets matching the rule. (in the manual page but not in --help) | man |
--ulog-qthreshold threshold | Queue at most threshold number of packets before sending them to userspace with a netlink socket. (in the manual page but not in --help) | man |
--arpreply-mac address | Specifies the MAC address to reply with: the Ethernet source MAC and the ARP payload source MAC will be filled in with this address. (in the manual page but not in --help) | man |
--arpreply-target target | Specifies the standard target. (in the manual page but not in --help) | man |
--to-destination address | Change the destination MAC address to the specified address. (in the manual page but not in --help) | man |
--dnat-target target | Specifies the standard target. (in the manual page but not in --help) | man |
--mark-set value | Mark the frame with the specified non-negative value. (in the manual page but not in --help) | man |
--mark-or value | Or the frame with the specified non-negative value. (in the manual page but not in --help) | man |
--mark-and value | And the frame with the specified non-negative value. (in the manual page but not in --help) | man |
--mark-xor value | Xor the frame with the specified non-negative value. (in the manual page but not in --help) | man |
--mark-target target | Specifies the standard target. (in the manual page but not in --help) | man |
--redirect-target target | Specifies the standard target. (in the manual page but not in --help) | man |
--to-source address | Changes the source MAC address to the specified address. (in the manual page but not in --help) | man |
--snat-target target | Specifies the standard target. (in the manual page but not in --help) | man |
--snat-arp | Also change the hardware source address inside the arp header if the packet is an arp message and the hardware address length in the arp header is 6 bytes. (in the manual page but not in --help) | man |