From 0cb2b74ea50ecc91a4a743ddd2ca5f63058dda0d Mon Sep 17 00:00:00 2001 From: Akihiro MOTOKI Date: Wed, 3 Apr 2013 13:09:23 +0900 Subject: [PATCH] iptables: Update po files --- original/man3/libipq.3 | 4 +- po4a/cmd/iptables-cmd.cfg | 3 + po4a/cmd/iptables-cmd.pot | 8027 ++++++++++++++++--------------- po4a/cmd/ja.po | 11317 +++++++++++++++++++++++--------------------- po4a/lib/iptables-lib.pot | 2 +- 5 files changed, 10326 insertions(+), 9027 deletions(-) diff --git a/original/man3/libipq.3 b/original/man3/libipq.3 index 611fcdf..e619c23 100644 --- a/original/man3/libipq.3 +++ b/original/man3/libipq.3 @@ -46,9 +46,9 @@ and queued for userspace processing via the QUEUE target. For example, running the following commands: .PP # modprobe iptable_filter -.br +.br # modprobe ip_queue -.br +.br # iptables \-A OUTPUT \-p icmp \-j QUEUE .PP will cause any locally generated ICMP packets (e.g. ping output) to diff --git a/po4a/cmd/iptables-cmd.cfg b/po4a/cmd/iptables-cmd.cfg index feeed97..ad40403 100644 --- a/po4a/cmd/iptables-cmd.cfg +++ b/po4a/cmd/iptables-cmd.cfg @@ -18,6 +18,9 @@ [type: man] original/man8/iptables.8 $lang:draft/man8/iptables.8 \ add_$lang:?po4a/add_$lang/copyright/iptables.8.txt +[type: man] original/man8/iptables-extensions.8 $lang:draft/man8/iptables-extensions.8 \ + add_$lang:?po4a/add_$lang/copyright/iptables-extensions.8.txt + [type: man] original/man8/iptables-apply.8 $lang:draft/man8/iptables-apply.8 \ add_$lang:?po4a/add_$lang/copyright/iptables-apply.8.txt diff --git a/po4a/cmd/iptables-cmd.pot b/po4a/cmd/iptables-cmd.pot index f7afd43..f2545b7 100644 --- a/po4a/cmd/iptables-cmd.pot +++ b/po4a/cmd/iptables-cmd.pot @@ -7,7 +7,7 @@ msgid "" msgstr "" "Project-Id-Version: PACKAGE VERSION\n" -"POT-Creation-Date: 2012-05-10 06:40+0900\n" +"POT-Creation-Date: 2013-04-03 12:30+0900\n" "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" "Last-Translator: FULL NAME \n" "Language-Team: LANGUAGE \n" @@ -46,7 +46,7 @@ msgstr "" #. along with this program; if not, write to the Free Software #. Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. #. type: SH -#: original/man8/ip6tables-restore.8:21 original/man8/ip6tables-save.8:21 original/man8/ip6tables.8:27 original/man8/iptables-restore.8:21 original/man8/iptables-save.8:21 original/man8/iptables.8:25 original/man8/iptables-apply.8:8 original/man1/iptables-xml.1:21 +#: original/man8/ip6tables-restore.8:21 original/man8/ip6tables-save.8:21 original/man8/ip6tables.8:27 original/man8/iptables-restore.8:21 original/man8/iptables-save.8:21 original/man8/iptables.8:25 original/man8/iptables-extensions.8:2 original/man8/iptables-apply.8:8 original/man1/iptables-xml.1:21 #, no-wrap msgid "NAME" msgstr "" @@ -57,59 +57,108 @@ msgid "ip6tables-restore \\(em Restore IPv6 Tables" msgstr "" #. type: SH -#: original/man8/ip6tables-restore.8:23 original/man8/ip6tables-save.8:23 original/man8/ip6tables.8:29 original/man8/iptables-restore.8:23 original/man8/iptables-save.8:23 original/man8/iptables.8:27 original/man8/iptables-apply.8:10 original/man1/iptables-xml.1:23 +#: original/man8/ip6tables-restore.8:23 original/man8/ip6tables-save.8:23 original/man8/ip6tables.8:29 original/man8/iptables-restore.8:23 original/man8/iptables-save.8:23 original/man8/iptables.8:27 original/man8/iptables-extensions.8:4 original/man8/iptables-apply.8:10 original/man1/iptables-xml.1:23 #, no-wrap msgid "SYNOPSIS" msgstr "" #. type: Plain text -#: original/man8/ip6tables-restore.8:25 -msgid "B [B<-c>] [B<-n>]" +#: original/man8/ip6tables-restore.8:26 +msgid "B [B<-chntv>] [B<-M> I] [B<-T> I]" msgstr "" #. type: SH -#: original/man8/ip6tables-restore.8:25 original/man8/ip6tables-save.8:26 original/man8/ip6tables.8:55 original/man8/iptables-restore.8:25 original/man8/iptables-save.8:26 original/man8/iptables.8:54 original/man8/iptables-apply.8:12 original/man1/iptables-xml.1:25 +#: original/man8/ip6tables-restore.8:26 original/man8/ip6tables-save.8:26 original/man8/ip6tables.8:55 original/man8/iptables-restore.8:26 original/man8/iptables-save.8:26 original/man8/iptables.8:54 original/man8/iptables-apply.8:12 original/man1/iptables-xml.1:25 #, no-wrap msgid "DESCRIPTION" msgstr "" #. type: Plain text -#: original/man8/ip6tables-restore.8:30 +#: original/man8/ip6tables-restore.8:31 msgid "" "B is used to restore IPv6 Tables from data specified on " "STDIN. Use I/O redirection provided by your shell to read from a file" msgstr "" #. type: TP -#: original/man8/ip6tables-restore.8:30 original/man8/ip6tables-save.8:35 original/man8/iptables-restore.8:30 original/man8/iptables-save.8:35 +#: original/man8/ip6tables-restore.8:31 original/man8/ip6tables-save.8:35 original/man8/iptables-restore.8:31 original/man8/iptables-save.8:35 #, no-wrap msgid "B<-c>, B<--counters>" msgstr "" #. type: Plain text -#: original/man8/ip6tables-restore.8:33 original/man8/iptables-restore.8:33 +#: original/man8/ip6tables-restore.8:34 original/man8/iptables-restore.8:34 msgid "restore the values of all packet and byte counters" msgstr "" #. type: TP -#: original/man8/ip6tables-restore.8:33 original/man8/iptables-restore.8:33 +#: original/man8/ip6tables-restore.8:34 original/man8/iptables-restore.8:34 original/man8/iptables-apply.8:28 +#, no-wrap +msgid "B<-h>, B<--help>" +msgstr "" + +#. type: Plain text +#: original/man8/ip6tables-restore.8:37 original/man8/iptables-restore.8:37 +msgid "Print a short option summary." +msgstr "" + +#. type: TP +#: original/man8/ip6tables-restore.8:37 original/man8/iptables-restore.8:37 #, no-wrap msgid "B<-n>, B<--noflush> " msgstr "" #. type: Plain text -#: original/man8/ip6tables-restore.8:36 -msgid "don't flush the previous contents of the table. If not specified," +#: original/man8/ip6tables-restore.8:42 +msgid "" +"don't flush the previous contents of the table. If not specified, " +"B flushes (deletes) all previous contents of the " +"respective table." +msgstr "" + +#. type: TP +#: original/man8/ip6tables-restore.8:42 original/man8/iptables-restore.8:42 +#, no-wrap +msgid "B<-t>, B<--test>" +msgstr "" + +#. type: Plain text +#: original/man8/ip6tables-restore.8:45 original/man8/iptables-restore.8:45 +msgid "Only parse and construct the ruleset, but do not commit it." +msgstr "" + +#. type: TP +#: original/man8/ip6tables-restore.8:45 original/man8/ip6tables.8:355 original/man8/iptables-restore.8:45 original/man8/iptables.8:343 original/man1/iptables-xml.1:38 +#, no-wrap +msgid "B<-v>, B<--verbose>" +msgstr "" + +#. type: Plain text +#: original/man8/ip6tables-restore.8:48 original/man8/iptables-restore.8:48 +msgid "Print additional debug info during ruleset processing." +msgstr "" + +#. type: TP +#: original/man8/ip6tables-restore.8:48 original/man8/iptables-restore.8:48 +#, no-wrap +msgid "B<-M>, B<--modprobe> I" +msgstr "" + +#. type: Plain text +#: original/man8/ip6tables-restore.8:52 +msgid "" +"Specify the path to the modprobe program. By default, ip6tables-restore will " +"inspect /proc/sys/kernel/modprobe to determine the executable's path." msgstr "" #. type: TP -#: original/man8/ip6tables-restore.8:36 original/man8/iptables-restore.8:38 +#: original/man8/ip6tables-restore.8:52 original/man8/iptables-restore.8:52 #, no-wrap msgid "B<-T>, B<--table> I" msgstr "" #. type: Plain text -#: original/man8/ip6tables-restore.8:41 +#: original/man8/ip6tables-restore.8:57 msgid "" "Restore only the named table even if the input stream contains other ones. " "B flushes (deletes) all previous contents of the " @@ -117,45 +166,45 @@ msgid "" msgstr "" #. type: SH -#: original/man8/ip6tables-restore.8:41 original/man8/ip6tables-save.8:42 original/man8/ip6tables.8:2447 original/man8/iptables-restore.8:41 original/man8/iptables-save.8:42 original/man8/iptables.8:2606 original/man1/iptables-xml.1:82 +#: original/man8/ip6tables-restore.8:57 original/man8/ip6tables-save.8:42 original/man8/ip6tables.8:395 original/man8/iptables-restore.8:55 original/man8/iptables-save.8:42 original/man8/iptables.8:383 original/man1/iptables-xml.1:82 #, no-wrap msgid "BUGS" msgstr "" #. type: Plain text -#: original/man8/ip6tables-restore.8:43 original/man8/ip6tables-save.8:44 original/man8/iptables-restore.8:43 original/man8/iptables-save.8:44 +#: original/man8/ip6tables-restore.8:59 original/man8/ip6tables-save.8:44 original/man8/iptables-restore.8:57 original/man8/iptables-save.8:44 msgid "None known as of iptables-1.2.1 release" msgstr "" #. type: SH -#: original/man8/ip6tables-restore.8:43 original/man8/ip6tables-save.8:44 original/man8/ip6tables.8:2480 original/man8/iptables.8:2650 +#: original/man8/ip6tables-restore.8:59 original/man8/ip6tables-save.8:44 original/man8/ip6tables.8:430 original/man8/iptables.8:429 #, no-wrap msgid "AUTHORS" msgstr "" #. type: Plain text -#: original/man8/ip6tables-restore.8:45 original/man8/ip6tables-save.8:46 original/man8/iptables-restore.8:45 original/man8/iptables-save.8:46 +#: original/man8/ip6tables-restore.8:61 original/man8/ip6tables-save.8:46 original/man8/iptables-restore.8:59 original/man8/iptables-save.8:46 msgid "Harald Welte Elaforge@gnumonks.orgE" msgstr "" #. type: Plain text -#: original/man8/ip6tables-restore.8:47 original/man8/ip6tables-save.8:48 +#: original/man8/ip6tables-restore.8:63 original/man8/ip6tables-save.8:48 msgid "Andras Kis-Szabo Ekisza@sch.bme.huE" msgstr "" #. type: SH -#: original/man8/ip6tables-restore.8:47 original/man8/ip6tables-save.8:48 original/man8/ip6tables.8:2464 original/man8/iptables-restore.8:45 original/man8/iptables-save.8:46 original/man8/iptables.8:2634 original/man8/iptables-apply.8:34 original/man1/iptables-xml.1:86 +#: original/man8/ip6tables-restore.8:63 original/man8/ip6tables-save.8:48 original/man8/ip6tables.8:412 original/man8/iptables-restore.8:59 original/man8/iptables-save.8:46 original/man8/iptables.8:411 original/man8/iptables-apply.8:34 original/man1/iptables-xml.1:86 #, no-wrap msgid "SEE ALSO" msgstr "" #. type: Plain text -#: original/man8/ip6tables-restore.8:49 +#: original/man8/ip6tables-restore.8:65 msgid "B(8), B(8)" msgstr "" #. type: Plain text -#: original/man8/ip6tables-restore.8:52 original/man8/ip6tables-save.8:53 original/man8/iptables-restore.8:50 original/man8/iptables-save.8:51 +#: original/man8/ip6tables-restore.8:68 original/man8/ip6tables-save.8:53 original/man8/iptables-restore.8:64 original/man8/iptables-save.8:51 msgid "" "The iptables-HOWTO, which details more iptables usage, the NAT-HOWTO, which " "details NAT, and the netfilter-hacking-HOWTO which details the internals." @@ -228,9 +277,9 @@ msgid "IP6TABLES" msgstr "" #. type: TH -#: original/man8/ip6tables.8:1 original/man8/ip6tables.8:1 original/man8/iptables.8:1 original/man8/iptables.8:1 +#: original/man8/ip6tables.8:1 original/man8/ip6tables.8:1 original/man8/iptables.8:1 original/man8/iptables.8:1 original/man8/iptables-extensions.8:1 original/man8/iptables-extensions.8:1 #, no-wrap -msgid "iptables 1.4.13" +msgid "iptables 1.4.18" msgstr "" #. type: Plain text @@ -355,8 +404,8 @@ msgstr "" #. type: Plain text #: original/man8/ip6tables.8:93 original/man8/iptables.8:92 msgid "" -"There are currently three independent tables (which tables are present at " -"any time depends on the kernel configuration options and which modules are " +"There are currently five independent tables (which tables are present at any " +"time depends on the kernel configuration options and which modules are " "present)." msgstr "" @@ -396,13 +445,29 @@ msgid "" msgstr "" #. type: TP -#: original/man8/ip6tables.8:108 original/man8/iptables.8:114 +#: original/man8/ip6tables.8:108 original/man8/iptables.8:107 +#, no-wrap +msgid "B:" +msgstr "" + +#. type: Plain text +#: original/man8/ip6tables.8:115 +msgid "" +"This table is consulted when a packet that creates a new connection is " +"encountered. It consists of three built-ins: B (for altering " +"packets as soon as they come in), B (for altering locally-generated " +"packets before routing), and B (for altering packets as they " +"are about to go out). Available since kernel 3.7." +msgstr "" + +#. type: TP +#: original/man8/ip6tables.8:115 original/man8/iptables.8:114 #, no-wrap msgid "B:" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:118 original/man8/iptables.8:124 +#: original/man8/ip6tables.8:125 original/man8/iptables.8:124 msgid "" "This table is used for specialized packet alteration. Until kernel 2.4.17 " "it had two built-in chains: B (for altering incoming packets " @@ -414,13 +479,13 @@ msgid "" msgstr "" #. type: TP -#: original/man8/ip6tables.8:118 original/man8/iptables.8:124 +#: original/man8/ip6tables.8:125 original/man8/iptables.8:124 #, no-wrap msgid "B:" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:126 original/man8/iptables.8:132 +#: original/man8/ip6tables.8:133 original/man8/iptables.8:132 msgid "" "This table is used mainly for configuring exemptions from connection " "tracking in combination with the NOTRACK target. It registers at the " @@ -431,13 +496,13 @@ msgid "" msgstr "" #. type: TP -#: original/man8/ip6tables.8:126 original/man8/iptables.8:132 +#: original/man8/ip6tables.8:133 original/man8/iptables.8:132 #, no-wrap msgid "B:" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:137 original/man8/iptables.8:143 +#: original/man8/ip6tables.8:144 original/man8/iptables.8:143 msgid "" "This table is used for Mandatory Access Control (MAC) networking rules, such " "as those enabled by the B and B targets. Mandatory " @@ -451,26 +516,26 @@ msgid "" msgstr "" #. type: SH -#: original/man8/ip6tables.8:138 original/man8/iptables.8:144 original/man8/iptables-apply.8:23 +#: original/man8/ip6tables.8:145 original/man8/iptables.8:144 original/man8/iptables-apply.8:23 #, no-wrap msgid "OPTIONS" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:141 +#: original/man8/ip6tables.8:148 msgid "" "The options that are recognized by B can be divided into several " "different groups." msgstr "" #. type: SS -#: original/man8/ip6tables.8:141 original/man8/iptables.8:147 +#: original/man8/ip6tables.8:148 original/man8/iptables.8:147 #, no-wrap msgid "COMMANDS" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:147 +#: original/man8/ip6tables.8:154 msgid "" "These options specify the specific action to perform. Only one of them can " "be specified on the command line unless otherwise specified below. For all " @@ -480,13 +545,13 @@ msgid "" msgstr "" #. type: TP -#: original/man8/ip6tables.8:147 original/man8/ip6tables.8:230 original/man8/iptables.8:153 +#: original/man8/ip6tables.8:154 original/man8/ip6tables.8:237 original/man8/iptables.8:153 #, no-wrap msgid "B<-A>, B<--append> I" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:152 original/man8/ip6tables.8:235 original/man8/iptables.8:158 +#: original/man8/ip6tables.8:159 original/man8/ip6tables.8:242 original/man8/iptables.8:158 msgid "" "Append one or more rules to the end of the selected chain. When the source " "and/or destination names resolve to more than one address, a rule will be " @@ -494,13 +559,13 @@ msgid "" msgstr "" #. type: TP -#: original/man8/ip6tables.8:152 original/man8/iptables.8:158 +#: original/man8/ip6tables.8:159 original/man8/iptables.8:158 #, no-wrap msgid "B<-C>, B<--check> I" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:158 original/man8/iptables.8:164 +#: original/man8/ip6tables.8:165 original/man8/iptables.8:164 msgid "" "Check whether a rule matching the specification does exist in the selected " "chain. This command uses the same logic as B<-D> to find a matching entry, " @@ -509,19 +574,19 @@ msgid "" msgstr "" #. type: TP -#: original/man8/ip6tables.8:158 original/man8/iptables.8:164 +#: original/man8/ip6tables.8:165 original/man8/iptables.8:164 #, no-wrap msgid "B<-D>, B<--delete> I" msgstr "" #. type: TP -#: original/man8/ip6tables.8:161 original/man8/iptables.8:167 +#: original/man8/ip6tables.8:168 original/man8/iptables.8:167 #, no-wrap msgid "B<-D>, B<--delete> I" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:166 original/man8/iptables.8:172 +#: original/man8/ip6tables.8:173 original/man8/iptables.8:172 msgid "" "Delete one or more rules from the selected chain. There are two versions of " "this command: the rule can be specified as a number in the chain (starting " @@ -529,13 +594,13 @@ msgid "" msgstr "" #. type: TP -#: original/man8/ip6tables.8:166 original/man8/iptables.8:172 +#: original/man8/ip6tables.8:173 original/man8/iptables.8:172 #, no-wrap msgid "B<-I>, B<--insert> I [I] I" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:172 original/man8/iptables.8:178 +#: original/man8/ip6tables.8:179 original/man8/iptables.8:178 msgid "" "Insert one or more rules in the selected chain as the given rule number. " "So, if the rule number is 1, the rule or rules are inserted at the head of " @@ -543,13 +608,13 @@ msgid "" msgstr "" #. type: TP -#: original/man8/ip6tables.8:172 original/man8/iptables.8:178 +#: original/man8/ip6tables.8:179 original/man8/iptables.8:178 #, no-wrap msgid "B<-R>, B<--replace> I" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:177 original/man8/iptables.8:183 +#: original/man8/ip6tables.8:184 original/man8/iptables.8:183 msgid "" "Replace a rule in the selected chain. If the source and/or destination " "names resolve to multiple addresses, the command will fail. Rules are " @@ -557,13 +622,13 @@ msgid "" msgstr "" #. type: TP -#: original/man8/ip6tables.8:177 original/man8/iptables.8:183 +#: original/man8/ip6tables.8:184 original/man8/iptables.8:183 #, no-wrap msgid "B<-L>, B<--list> [I]" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:182 +#: original/man8/ip6tables.8:189 msgid "" "List all rules in the selected chain. If no chain is selected, all chains " "are listed. Like every other ip6tables command, it applies to the specified " @@ -571,7 +636,7 @@ msgid "" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:189 original/man8/iptables.8:197 +#: original/man8/ip6tables.8:196 original/man8/iptables.8:197 msgid "" "Please note that it is often used with the B<-n> option, in order to avoid " "long reverse DNS lookups. It is legal to specify the B<-Z> (zero) option as " @@ -581,19 +646,19 @@ msgid "" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:191 +#: original/man8/ip6tables.8:198 #, no-wrap msgid " ip6tables -L -v\n" msgstr "" #. type: TP -#: original/man8/ip6tables.8:192 original/man8/iptables.8:200 +#: original/man8/ip6tables.8:199 original/man8/iptables.8:200 #, no-wrap msgid "B<-S>, B<--list-rules> [I]" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:197 +#: original/man8/ip6tables.8:204 msgid "" "Print all rules in the selected chain. If no chain is selected, all chains " "are printed like ip6tables-save. Like every other ip6tables command, it " @@ -601,26 +666,26 @@ msgid "" msgstr "" #. type: TP -#: original/man8/ip6tables.8:197 original/man8/iptables.8:205 +#: original/man8/ip6tables.8:204 original/man8/iptables.8:205 #, no-wrap msgid "B<-F>, B<--flush> [I]" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:201 original/man8/iptables.8:209 +#: original/man8/ip6tables.8:208 original/man8/iptables.8:209 msgid "" "Flush the selected chain (all the chains in the table if none is given). " "This is equivalent to deleting all the rules one by one." msgstr "" #. type: TP -#: original/man8/ip6tables.8:201 original/man8/iptables.8:209 +#: original/man8/ip6tables.8:208 original/man8/iptables.8:209 #, no-wrap msgid "B<-Z>, B<--zero> [I [I]]" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:209 original/man8/iptables.8:217 +#: original/man8/ip6tables.8:216 original/man8/iptables.8:217 msgid "" "Zero the packet and byte counters in all chains, or only the given chain, or " "only the given rule in a chain. It is legal to specify the B<-L>, B<--list> " @@ -629,26 +694,26 @@ msgid "" msgstr "" #. type: TP -#: original/man8/ip6tables.8:209 original/man8/iptables.8:217 +#: original/man8/ip6tables.8:216 original/man8/iptables.8:217 #, no-wrap msgid "B<-N>, B<--new-chain> I" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:213 original/man8/iptables.8:221 +#: original/man8/ip6tables.8:220 original/man8/iptables.8:221 msgid "" "Create a new user-defined chain by the given name. There must be no target " "of that name already." msgstr "" #. type: TP -#: original/man8/ip6tables.8:213 original/man8/iptables.8:221 +#: original/man8/ip6tables.8:220 original/man8/iptables.8:221 #, no-wrap msgid "B<-X>, B<--delete-chain> [I]" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:220 original/man8/iptables.8:228 +#: original/man8/ip6tables.8:227 original/man8/iptables.8:228 msgid "" "Delete the optional user-defined chain specified. There must be no " "references to the chain. If there are, you must delete or replace the " @@ -658,13 +723,13 @@ msgid "" msgstr "" #. type: TP -#: original/man8/ip6tables.8:220 original/man8/iptables.8:228 +#: original/man8/ip6tables.8:227 original/man8/iptables.8:228 #, no-wrap msgid "B<-P>, B<--policy> I" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:226 original/man8/iptables.8:234 +#: original/man8/ip6tables.8:233 original/man8/iptables.8:234 msgid "" "Set the policy for the chain to the given target. See the section " "B for the legal targets. Only built-in (non-user-defined) chains " @@ -673,50 +738,76 @@ msgid "" msgstr "" #. type: TP -#: original/man8/ip6tables.8:226 original/man8/iptables.8:234 +#: original/man8/ip6tables.8:233 original/man8/iptables.8:234 #, no-wrap msgid "B<-E>, B<--rename-chain> I" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:230 original/man8/iptables.8:238 +#: original/man8/ip6tables.8:237 original/man8/iptables.8:238 msgid "" "Rename the user specified chain to the user supplied name. This is " "cosmetic, and has no effect on the structure of the table." msgstr "" #. type: TP -#: original/man8/ip6tables.8:235 original/man8/iptables.8:238 +#: original/man8/ip6tables.8:242 original/man8/iptables.8:238 #, no-wrap msgid "B<-h>" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:239 original/man8/iptables.8:242 +#: original/man8/ip6tables.8:246 original/man8/iptables.8:242 msgid "Help. Give a (currently very brief) description of the command syntax." msgstr "" #. type: SS -#: original/man8/ip6tables.8:239 original/man8/iptables.8:242 +#: original/man8/ip6tables.8:246 original/man8/iptables.8:242 #, no-wrap msgid "PARAMETERS" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:242 original/man8/iptables.8:245 +#: original/man8/ip6tables.8:249 original/man8/iptables.8:245 msgid "" "The following parameters make up a rule specification (as used in the add, " "delete, insert, replace and append commands)." msgstr "" #. type: TP -#: original/man8/ip6tables.8:242 original/man8/iptables.8:245 +#: original/man8/ip6tables.8:249 original/man8/iptables.8:245 +#, no-wrap +msgid "B<-4>, B<--ipv4>" +msgstr "" + +#. type: Plain text +#: original/man8/ip6tables.8:255 +msgid "" +"If a rule using the B<-4> option is inserted with (and only with) " +"ip6tables-restore, it will be silently ignored. Any other uses will throw an " +"error. This option allows to put both IPv4 and IPv6 rules in a single rule " +"file for use with both iptables-restore and ip6tables-restore." +msgstr "" + +#. type: TP +#: original/man8/ip6tables.8:255 original/man8/iptables.8:248 +#, no-wrap +msgid "B<-6>, B<--ipv6>" +msgstr "" + +#. type: Plain text +#: original/man8/ip6tables.8:258 +msgid "This option has no effect in ip6tables and ip6tables-restore." +msgstr "" + +#. type: TP +#: original/man8/ip6tables.8:258 original/man8/iptables.8:254 #, no-wrap msgid "[B] B<-p>, B<--protocol> I" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:260 +#: original/man8/ip6tables.8:276 msgid "" "The protocol of the rule or of the packet to check. The specified protocol " "can be one of B, B, B, B, B, B or the " @@ -733,13 +824,13 @@ msgid "" msgstr "" #. type: TP -#: original/man8/ip6tables.8:260 +#: original/man8/ip6tables.8:276 #, no-wrap msgid "[B] B<-s>, B<--source> I
[BI]" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:277 +#: original/man8/ip6tables.8:293 msgid "" "Source specification. I
can be either be a hostname, a network IP " "address (with BI), or a plain IP address. Names will be resolved " @@ -755,13 +846,13 @@ msgid "" msgstr "" #. type: TP -#: original/man8/ip6tables.8:277 +#: original/man8/ip6tables.8:293 #, no-wrap msgid "[B] B<-d>, B<--destination> I
[BI]" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:283 original/man8/iptables.8:279 +#: original/man8/ip6tables.8:299 original/man8/iptables.8:288 msgid "" "Destination specification. See the description of the B<-s> (source) flag " "for a detailed description of the syntax. The flag B<--dst> is an alias for " @@ -769,13 +860,29 @@ msgid "" msgstr "" #. type: TP -#: original/man8/ip6tables.8:283 original/man8/iptables.8:279 +#: original/man8/ip6tables.8:299 original/man8/iptables.8:288 +#, no-wrap +msgid "B<-m>, B<--match> I" +msgstr "" + +#. type: Plain text +#: original/man8/ip6tables.8:306 original/man8/iptables.8:295 +msgid "" +"Specifies a match to use, that is, an extension module that tests for a " +"specific property. The set of matches make up the condition under which a " +"target is invoked. Matches are evaluated first to last as specified on the " +"command line and work in short-circuit fashion, i.e. if one extension yields " +"false, evaluation will stop." +msgstr "" + +#. type: TP +#: original/man8/ip6tables.8:306 original/man8/iptables.8:295 #, no-wrap msgid "B<-j>, B<--jump> I" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:294 original/man8/iptables.8:290 +#: original/man8/ip6tables.8:317 original/man8/iptables.8:306 msgid "" "This specifies the target of the rule; i.e., what to do if the packet " "matches it. The target can be a user-defined chain (other than the one this " @@ -787,13 +894,13 @@ msgid "" msgstr "" #. type: TP -#: original/man8/ip6tables.8:294 original/man8/iptables.8:290 +#: original/man8/ip6tables.8:317 original/man8/iptables.8:306 #, no-wrap msgid "B<-g>, B<--goto> I" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:300 original/man8/iptables.8:296 +#: original/man8/ip6tables.8:323 original/man8/iptables.8:312 msgid "" "This specifies that the processing should continue in a user specified " "chain. Unlike the --jump option return will not continue processing in this " @@ -801,13 +908,13 @@ msgid "" msgstr "" #. type: TP -#: original/man8/ip6tables.8:300 original/man8/iptables.8:296 +#: original/man8/ip6tables.8:323 original/man8/iptables.8:312 #, no-wrap msgid "[B] B<-i>, B<--in-interface> I" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:308 original/man8/iptables.8:304 +#: original/man8/ip6tables.8:331 original/man8/iptables.8:320 msgid "" "Name of an interface via which a packet was received (only for packets " "entering the B, B and B chains). When the \"!\" " @@ -817,13 +924,13 @@ msgid "" msgstr "" #. type: TP -#: original/man8/ip6tables.8:308 original/man8/iptables.8:304 +#: original/man8/ip6tables.8:331 original/man8/iptables.8:320 #, no-wrap msgid "[B] B<-o>, B<--out-interface> I" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:325 original/man8/iptables.8:312 +#: original/man8/ip6tables.8:348 original/man8/iptables.8:328 msgid "" "Name of an interface via which a packet is going to be sent (for packets " "entering the B, B and B chains). When the " @@ -834,37 +941,31 @@ msgid "" msgstr "" #. type: TP -#: original/man8/ip6tables.8:325 original/man8/iptables.8:320 +#: original/man8/ip6tables.8:348 original/man8/iptables.8:336 #, no-wrap msgid "B<-c>, B<--set-counters> I" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:330 original/man8/iptables.8:325 +#: original/man8/ip6tables.8:353 original/man8/iptables.8:341 msgid "" "This enables the administrator to initialize the packet and byte counters of " "a rule (during B, B, B operations)." msgstr "" #. type: SS -#: original/man8/ip6tables.8:330 original/man8/iptables.8:325 +#: original/man8/ip6tables.8:353 original/man8/iptables.8:341 #, no-wrap msgid "OTHER OPTIONS" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:332 original/man8/iptables.8:327 +#: original/man8/ip6tables.8:355 original/man8/iptables.8:343 msgid "The following additional options can be specified:" msgstr "" -#. type: TP -#: original/man8/ip6tables.8:332 original/man8/iptables.8:327 original/man1/iptables-xml.1:38 -#, no-wrap -msgid "B<-v>, B<--verbose>" -msgstr "" - #. type: Plain text -#: original/man8/ip6tables.8:342 original/man8/iptables.8:337 +#: original/man8/ip6tables.8:365 original/man8/iptables.8:353 msgid "" "Verbose output. This option makes the list command show the interface name, " "the rule options (if any), and the TOS masks. The packet and byte counters " @@ -876,13 +977,13 @@ msgid "" msgstr "" #. type: TP -#: original/man8/ip6tables.8:342 original/man8/iptables.8:337 +#: original/man8/ip6tables.8:365 original/man8/iptables.8:353 #, no-wrap msgid "B<-n>, B<--numeric>" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:348 original/man8/iptables.8:343 +#: original/man8/ip6tables.8:371 original/man8/iptables.8:359 msgid "" "Numeric output. IP addresses and port numbers will be printed in numeric " "format. By default, the program will try to display them as host names, " @@ -890,13 +991,13 @@ msgid "" msgstr "" #. type: TP -#: original/man8/ip6tables.8:348 original/man8/iptables.8:343 +#: original/man8/ip6tables.8:371 original/man8/iptables.8:359 #, no-wrap msgid "B<-x>, B<--exact>" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:355 original/man8/iptables.8:350 +#: original/man8/ip6tables.8:378 original/man8/iptables.8:366 msgid "" "Expand numbers. Display the exact value of the packet and byte counters, " "instead of only the rounded number in K's (multiples of 1000) M's " @@ -905,6792 +1006,7354 @@ msgid "" msgstr "" #. type: TP -#: original/man8/ip6tables.8:355 original/man8/iptables.8:350 +#: original/man8/ip6tables.8:378 original/man8/iptables.8:366 #, no-wrap msgid "B<--line-numbers>" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:359 original/man8/iptables.8:354 +#: original/man8/ip6tables.8:382 original/man8/iptables.8:370 msgid "" "When listing rules, add line numbers to the beginning of each rule, " "corresponding to that rule's position in the chain." msgstr "" #. type: TP -#: original/man8/ip6tables.8:359 original/man8/iptables.8:354 +#: original/man8/ip6tables.8:382 original/man8/iptables.8:370 #, no-wrap msgid "B<--modprobe=>I" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:363 original/man8/iptables.8:358 +#: original/man8/ip6tables.8:386 original/man8/iptables.8:374 msgid "" "When adding or inserting rules into a chain, use I to load any " "necessary modules (targets, match extensions, etc)." msgstr "" #. type: SH -#: original/man8/ip6tables.8:363 original/man8/iptables.8:358 +#: original/man8/ip6tables.8:386 original/man8/iptables-extensions.8:10 #, no-wrap msgid "MATCH EXTENSIONS" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:373 -msgid "" -"ip6tables can use extended packet matching modules with the B<-m> or " -"B<--match> options, followed by the matching module name; after these, " -"various extra command line options become available, depending on the " -"specific module. You can specify multiple extended match modules in one " -"line, and you can use the B<-h> or B<--help> options after the module has " -"been specified to receive help specific to that module." -msgstr "" - -#. @MATCH@ -#. type: Plain text -#: original/man8/ip6tables.8:378 +#: original/man8/ip6tables.8:390 original/man8/iptables.8:378 msgid "" -"If the B<-p> or B<--protocol> was specified and if and only if an unknown " -"option is encountered, ip6tables will try load a match module of the same " -"name as the protocol, to try making the option available." +"iptables can use extended packet matching and target modules. A list of " +"these is available in the B(8) manpage." msgstr "" -#. type: SS -#: original/man8/ip6tables.8:378 original/man8/iptables.8:373 +#. type: SH +#: original/man8/ip6tables.8:390 original/man8/iptables.8:378 #, no-wrap -msgid "addrtype" +msgid "DIAGNOSTICS" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:383 original/man8/iptables.8:378 +#: original/man8/ip6tables.8:395 original/man8/iptables.8:383 msgid "" -"This module matches packets based on their B
Address types " -"are used within the kernel networking stack and categorize addresses into " -"various groups. The exact definition of that group depends on the specific " -"layer three protocol." +"Various error messages are printed to standard error. The exit code is 0 " +"for correct functioning. Errors which appear to be caused by invalid or " +"abused command line parameters cause an exit code of 2, and other errors " +"cause an exit code of 1." msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:385 original/man8/iptables.8:380 -msgid "The following address types are possible:" +#: original/man8/ip6tables.8:398 +msgid "Bugs? What's this? ;-) Well... the counters are not reliable on sparc64." msgstr "" -#. type: TP -#: original/man8/ip6tables.8:385 original/man8/iptables.8:380 +#. type: SH +#: original/man8/ip6tables.8:398 original/man8/iptables.8:386 #, no-wrap -msgid "B" +msgid "COMPATIBILITY WITH IPCHAINS" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:388 original/man8/iptables.8:383 -msgid "an unspecified address (i.e. 0.0.0.0)" -msgstr "" - -#. type: TP -#: original/man8/ip6tables.8:388 original/man8/iptables.8:383 -#, no-wrap -msgid "B" +#: original/man8/ip6tables.8:407 +msgid "" +"This B is very similar to ipchains by Rusty Russell. The main " +"difference is that the chains B and B are only traversed for " +"packets coming into the local host and originating from the local host " +"respectively. Hence every packet only passes through one of the three " +"chains (except loopback traffic, which involves both INPUT and OUTPUT " +"chains); previously a forwarded packet would pass through all three." msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:391 original/man8/iptables.8:386 -msgid "an unicast address" +#: original/man8/ip6tables.8:412 +msgid "" +"The other main difference is that B<-i> refers to the input interface; B<-o> " +"refers to the output interface, and both are available for packets entering " +"the B chain. There are several other changes in ip6tables." msgstr "" -#. type: TP -#: original/man8/ip6tables.8:391 original/man8/iptables.8:386 -#, no-wrap -msgid "B" +#. type: Plain text +#: original/man8/ip6tables.8:421 +msgid "" +"B(8), B(8), B(8), " +"B(8), B(8), B(8), " +"B(8), B(3)." msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:394 original/man8/iptables.8:389 -msgid "a local address" +#: original/man8/ip6tables.8:427 +msgid "" +"The packet-filtering-HOWTO details iptables usage for packet filtering, the " +"netfilter-extensions-HOWTO details the extensions that are not in the " +"standard distribution, and the netfilter-hacking-HOWTO details the netfilter " +"internals." msgstr "" -#. type: TP -#: original/man8/ip6tables.8:394 original/man8/iptables.8:389 -#, no-wrap -msgid "B" +#. type: Plain text +#: original/man8/ip6tables.8:430 original/man8/iptables.8:429 +msgid "See B." msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:397 original/man8/iptables.8:392 -msgid "a broadcast address" +#: original/man8/ip6tables.8:433 +msgid "Rusty Russell wrote iptables, in early consultation with Michael Neuling." msgstr "" -#. type: TP -#: original/man8/ip6tables.8:397 original/man8/iptables.8:392 -#, no-wrap -msgid "B" +#. type: Plain text +#: original/man8/ip6tables.8:437 original/man8/iptables.8:436 +msgid "" +"Marc Boucher made Rusty abandon ipnatctl by lobbying for a generic packet " +"selection framework in iptables, then wrote the mangle table, the owner " +"match, the mark stuff, and ran around doing cool stuff everywhere." msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:400 original/man8/iptables.8:395 -msgid "an anycast packet" +#: original/man8/ip6tables.8:439 original/man8/iptables.8:438 +msgid "James Morris wrote the TOS target, and tos match." msgstr "" -#. type: TP -#: original/man8/ip6tables.8:400 original/man8/iptables.8:395 -#, no-wrap -msgid "B" +#. type: Plain text +#: original/man8/ip6tables.8:441 original/man8/iptables.8:440 +msgid "Jozsef Kadlecsik wrote the REJECT target." msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:403 original/man8/iptables.8:398 -msgid "a multicast address" +#: original/man8/ip6tables.8:443 +msgid "" +"Harald Welte wrote the ULOG and NFQUEUE target, the new libiptc, as well as " +"TTL match+target and libipulog." msgstr "" -#. type: TP -#: original/man8/ip6tables.8:403 original/man8/iptables.8:398 -#, no-wrap -msgid "B" +#. type: Plain text +#: original/man8/ip6tables.8:447 original/man8/iptables.8:446 +msgid "" +"The Netfilter Core Team is: Marc Boucher, Martin Josefsson, Yasuyuki " +"Kozakai, Jozsef Kadlecsik, Patrick McHardy, James Morris, Pablo Neira Ayuso, " +"Harald Welte and Rusty Russell." msgstr "" +#. .. and did I mention that we are incredibly cool people? +#. .. sexy, too .. +#. .. witty, charming, powerful .. +#. .. and most of all, modest .. #. type: Plain text -#: original/man8/ip6tables.8:406 original/man8/iptables.8:401 -msgid "a blackhole address" +#: original/man8/ip6tables.8:454 +msgid "" +"ip6tables man page created by Andras Kis-Szabo, based on iptables man page " +"written by Herve Eychenne Erv@wallfire.orgE." msgstr "" -#. type: TP -#: original/man8/ip6tables.8:406 original/man8/iptables.8:401 +#. type: SH +#: original/man8/ip6tables.8:454 original/man8/iptables.8:452 #, no-wrap -msgid "B" +msgid "VERSION" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:409 original/man8/iptables.8:404 -msgid "an unreachable address" +#: original/man8/ip6tables.8:456 +msgid "This manual page applies to ip6tables 1.4.18." msgstr "" -#. type: TP -#: original/man8/ip6tables.8:409 original/man8/iptables.8:404 +#. type: TH +#: original/man8/iptables-restore.8:1 #, no-wrap -msgid "B" +msgid "IPTABLES-RESTORE" msgstr "" -#. type: Plain text -#: original/man8/ip6tables.8:412 original/man8/iptables.8:407 -msgid "a prohibited address" +#. type: TH +#: original/man8/iptables-restore.8:1 original/man8/iptables-save.8:1 +#, no-wrap +msgid "Jan 04, 2001" msgstr "" -#. type: TP -#: original/man8/ip6tables.8:412 original/man8/iptables.8:407 -#, no-wrap -msgid "B" +#. type: Plain text +#: original/man8/iptables-restore.8:23 +msgid "iptables-restore \\(em Restore IP Tables" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:415 original/man8/ip6tables.8:418 original/man8/iptables.8:410 original/man8/iptables.8:413 -msgid "FIXME" +#: original/man8/iptables-restore.8:26 +msgid "B [B<-chntv>] [B<-M> I] [B<-T> I]" msgstr "" -#. type: TP -#: original/man8/ip6tables.8:415 original/man8/iptables.8:410 -#, no-wrap -msgid "B" +#. type: Plain text +#: original/man8/iptables-restore.8:31 +msgid "" +"B is used to restore IP Tables from data specified on " +"STDIN. Use I/O redirection provided by your shell to read from a file" msgstr "" -#. type: TP -#: original/man8/ip6tables.8:418 original/man8/iptables.8:413 -#, no-wrap -msgid "B" +#. type: Plain text +#: original/man8/iptables-restore.8:42 +msgid "" +"don't flush the previous contents of the table. If not specified, " +"B flushes (deletes) all previous contents of the " +"respective table." msgstr "" -#. type: TP -#: original/man8/ip6tables.8:420 original/man8/iptables.8:415 -#, no-wrap -msgid "[B] B<--src-type> I" +#. type: Plain text +#: original/man8/iptables-restore.8:52 +msgid "" +"Specify the path to the modprobe program. By default, iptables-restore will " +"inspect /proc/sys/kernel/modprobe to determine the executable's path." msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:423 original/man8/iptables.8:418 -msgid "Matches if the source address is of given type" +#: original/man8/iptables-restore.8:55 +msgid "Restore only the named table even if the input stream contains other ones." msgstr "" -#. type: TP -#: original/man8/ip6tables.8:423 original/man8/iptables.8:418 +#. type: SH +#: original/man8/iptables-restore.8:57 original/man8/iptables-save.8:44 original/man1/iptables-xml.1:84 #, no-wrap -msgid "[B] B<--dst-type> I" +msgid "AUTHOR" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:426 original/man8/iptables.8:421 -msgid "Matches if the destination address is of given type" +#: original/man8/iptables-restore.8:61 +msgid "B(8), B(8)" msgstr "" -#. type: TP -#: original/man8/ip6tables.8:426 original/man8/iptables.8:421 +#. type: TH +#: original/man8/iptables-save.8:1 #, no-wrap -msgid "B<--limit-iface-in>" +msgid "IPTABLES-SAVE" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:437 original/man8/iptables.8:432 -msgid "" -"The address type checking can be limited to the interface the packet is " -"coming in. This option is only valid in the B, B and " -"B chains. It cannot be specified with the B<--limit-iface-out> " -"option." +#: original/man8/iptables-save.8:23 +msgid "iptables-save \\(em dump iptables rules to stdout" msgstr "" -#. type: TP -#: original/man8/ip6tables.8:437 original/man8/iptables.8:432 -#, no-wrap -msgid "B<--limit-iface-out>" +#. type: Plain text +#: original/man8/iptables-save.8:26 +msgid "B [B<-M> I] [B<-c>] [B<-t> I]" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:448 original/man8/iptables.8:443 +#: original/man8/iptables-save.8:31 msgid "" -"The address type checking can be limited to the interface the packet is " -"going out. This option is only valid in the B, B and " -"B chains. It cannot be specified with the B<--limit-iface-in> " -"option." -msgstr "" - -#. type: SS -#: original/man8/ip6tables.8:448 original/man8/iptables.8:443 -#, no-wrap -msgid "ah" +"B is used to dump the contents of an IP Table in easily " +"parseable format to STDOUT. Use I/O-redirection provided by your shell to " +"write to a file." msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:450 -msgid "" -"This module matches the parameters in Authentication header of IPsec " -"packets." +#: original/man8/iptables-save.8:48 +msgid "B(8), B(8)" msgstr "" -#. type: TP -#: original/man8/ip6tables.8:450 original/man8/iptables.8:445 +#. type: TH +#: original/man8/iptables.8:1 #, no-wrap -msgid "[B] B<--ahspi> I[B<:>I]" +msgid "IPTABLES" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:453 -msgid "Matches SPI." -msgstr "" - -#. type: TP -#: original/man8/ip6tables.8:453 -#, no-wrap -msgid "[B] B<--ahlen> I" +#: original/man8/iptables.8:27 +msgid "iptables \\(em administration tool for IPv4 packet filtering and NAT" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:456 original/man8/ip6tables.8:748 original/man8/ip6tables.8:870 -msgid "Total length of this header in octets." +#: original/man8/iptables.8:30 +msgid "" +"B [B<-t> I
] {B<-A>|B<-C>|B<-D>} I " +"I" msgstr "" -#. type: TP -#: original/man8/ip6tables.8:456 -#, no-wrap -msgid "B<--ahres>" +#. type: Plain text +#: original/man8/iptables.8:32 +msgid "" +"B [B<-t> I
] B<-I> I [I] " +"I" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:459 -msgid "Matches if the reserved field is filled with zero." +#: original/man8/iptables.8:34 +msgid "B [B<-t> I
] B<-R> I" msgstr "" -#. type: SS -#: original/man8/ip6tables.8:459 original/man8/iptables.8:447 -#, no-wrap -msgid "cluster" +#. type: Plain text +#: original/man8/iptables.8:36 +msgid "B [B<-t> I
] B<-D> I" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:462 original/man8/iptables.8:450 -msgid "" -"Allows you to deploy gateway and back-end load-sharing clusters without the " -"need of load-balancers." +#: original/man8/iptables.8:38 +msgid "B [B<-t> I
] B<-S> [I [I]]" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:465 original/man8/iptables.8:453 +#: original/man8/iptables.8:40 msgid "" -"This match requires that all the nodes see the same packets. Thus, the " -"cluster match decides if this node has to handle a packet given the " -"following options:" -msgstr "" - -#. type: TP -#: original/man8/ip6tables.8:465 original/man8/iptables.8:453 -#, no-wrap -msgid "B<--cluster-total-nodes> I" +"B [B<-t> I
] {B<-F>|B<-L>|B<-Z>} [I [I]] " +"[I]" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:468 original/man8/iptables.8:456 -msgid "Set number of total nodes in cluster." -msgstr "" - -#. type: TP -#: original/man8/ip6tables.8:468 original/man8/iptables.8:456 -#, no-wrap -msgid "[B] B<--cluster-local-node> I" +#: original/man8/iptables.8:42 +msgid "B [B<-t> I
] B<-N> I" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:471 original/man8/iptables.8:459 -msgid "Set the local node number ID." +#: original/man8/iptables.8:44 +msgid "B [B<-t> I
] B<-X> [I]" msgstr "" -#. type: TP -#: original/man8/ip6tables.8:471 original/man8/iptables.8:459 -#, no-wrap -msgid "[B] B<--cluster-local-nodemask> I" +#. type: Plain text +#: original/man8/iptables.8:46 +msgid "B [B<-t> I
] B<-P> I" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:475 original/man8/iptables.8:463 -msgid "" -"Set the local node number ID mask. You can use this option instead of " -"B<--cluster-local-node>." +#: original/man8/iptables.8:48 +msgid "B [B<-t> I
] B<-E> I" msgstr "" -#. type: TP -#: original/man8/ip6tables.8:475 original/man8/iptables.8:463 -#, no-wrap -msgid "B<--cluster-hash-seed> I" +#. type: Plain text +#: original/man8/iptables.8:50 +msgid "rule-specification = [I] [I]" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:478 original/man8/iptables.8:466 -msgid "Set seed value of the Jenkins hash." +#: original/man8/iptables.8:52 +msgid "match = B<-m> I [I]" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:480 original/man8/ip6tables.8:526 original/man8/ip6tables.8:563 original/man8/ip6tables.8:711 original/man8/ip6tables.8:1837 original/man8/ip6tables.8:1885 original/man8/ip6tables.8:1931 original/man8/iptables.8:468 original/man8/iptables.8:514 original/man8/iptables.8:551 original/man8/iptables.8:699 original/man8/iptables.8:1755 original/man8/iptables.8:1803 original/man8/iptables.8:1852 -#, no-wrap -msgid "Example:" +#: original/man8/iptables.8:54 +msgid "target = B<-j> I [I]" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:485 original/man8/iptables.8:473 +#: original/man8/iptables.8:60 msgid "" -"iptables -A PREROUTING -t mangle -i eth1 -m cluster --cluster-total-nodes 2 " -"--cluster-local-node 1 --cluster-hash-seed 0xdeadbeef -j MARK --set-mark " -"0xffff" +"B is used to set up, maintain, and inspect the tables of IPv4 " +"packet filter rules in the Linux kernel. Several different tables may be " +"defined. Each table contains a number of built-in chains and may also " +"contain user-defined chains." msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:490 original/man8/iptables.8:478 +#: original/man8/iptables.8:114 msgid "" -"iptables -A PREROUTING -t mangle -i eth2 -m cluster --cluster-total-nodes 2 " -"--cluster-local-node 1 --cluster-hash-seed 0xdeadbeef -j MARK --set-mark " -"0xffff" +"This table is consulted when a packet that creates a new connection is " +"encountered. It consists of three built-ins: B (for altering " +"packets as soon as they come in), B (for altering locally-generated " +"packets before routing), and B (for altering packets as they " +"are about to go out)." msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:493 original/man8/iptables.8:481 -msgid "iptables -A PREROUTING -t mangle -i eth1 -m mark ! --mark 0xffff -j DROP" +#: original/man8/iptables.8:147 +msgid "" +"The options that are recognized by B can be divided into several " +"different groups." msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:496 original/man8/iptables.8:484 -msgid "iptables -A PREROUTING -t mangle -i eth2 -m mark ! --mark 0xffff -j DROP" +#: original/man8/iptables.8:153 +msgid "" +"These options specify the desired action to perform. Only one of them can be " +"specified on the command line unless otherwise stated below. For long " +"versions of the command and option names, you need to use only enough " +"letters to ensure that B can differentiate it from all other " +"options." msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:498 original/man8/iptables.8:486 -msgid "And the following commands to make all nodes see the same packets:" +#: original/man8/iptables.8:188 +msgid "" +"List all rules in the selected chain. If no chain is selected, all chains " +"are listed. Like every other iptables command, it applies to the specified " +"table (filter is the default), so NAT rules get listed by" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:500 original/man8/iptables.8:488 -msgid "ip maddr add 01:00:5e:00:01:01 dev eth1" +#: original/man8/iptables.8:190 +#, no-wrap +msgid " iptables -t nat -n -L\n" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:502 original/man8/iptables.8:490 -msgid "ip maddr add 01:00:5e:00:01:02 dev eth2" +#: original/man8/iptables.8:199 +#, no-wrap +msgid " iptables -L -v\n" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:505 original/man8/iptables.8:493 +#: original/man8/iptables.8:205 msgid "" -"arptables -A OUTPUT -o eth1 --h-length 6 -j mangle --mangle-mac-s " -"01:00:5e:00:01:01" +"Print all rules in the selected chain. If no chain is selected, all chains " +"are printed like iptables-save. Like every other iptables command, it " +"applies to the specified table (filter is the default)." msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:509 original/man8/iptables.8:497 -msgid "" -"arptables -A INPUT -i eth1 --h-length 6 --destination-mac 01:00:5e:00:01:01 " -"-j mangle --mangle-mac-d 00:zz:yy:xx:5a:27" +#: original/man8/iptables.8:248 +msgid "This option has no effect in iptables and iptables-restore." msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:512 original/man8/iptables.8:500 +#: original/man8/iptables.8:254 msgid "" -"arptables -A OUTPUT -o eth2 --h-length 6 -j mangle --mangle-mac-s " -"01:00:5e:00:01:02" +"If a rule using the B<-6> option is inserted with (and only with) " +"iptables-restore, it will be silently ignored. Any other uses will throw an " +"error. This option allows to put both IPv4 and IPv6 rules in a single rule " +"file for use with both iptables-restore and ip6tables-restore." msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:516 original/man8/iptables.8:504 +#: original/man8/iptables.8:265 msgid "" -"arptables -A INPUT -i eth2 --h-length 6 --destination-mac 01:00:5e:00:01:02 " -"-j mangle --mangle-mac-d 00:zz:yy:xx:5a:27" +"The protocol of the rule or of the packet to check. The specified protocol " +"can be one of B, B, B, B, B, B, B or " +"the special keyword \"B\", or it can be a numeric value, representing " +"one of these protocols or a different one. A protocol name from " +"/etc/protocols is also allowed. A \"!\" argument before the protocol " +"inverts the test. The number zero is equivalent to B. \"B\" will " +"match with all protocols and is taken as default when this option is " +"omitted." msgstr "" -#. type: Plain text -#: original/man8/ip6tables.8:520 original/man8/iptables.8:508 -msgid "" -"In the case of TCP connections, pickup facility has to be disabled to avoid " -"marking TCP ACK packets coming in the reply direction as valid." +#. type: TP +#: original/man8/iptables.8:265 +#, no-wrap +msgid "[B] B<-s>, B<--source> I
[BI][B<,>I<...>]" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:522 original/man8/iptables.8:510 -msgid "echo 0 E /proc/sys/net/netfilter/nf_conntrack_tcp_loose" +#: original/man8/iptables.8:282 +msgid "" +"Source specification. I
can be either a network name, a hostname, a " +"network IP address (with BI), or a plain IP address. Hostnames will " +"be resolved once only, before the rule is submitted to the kernel. Please " +"note that specifying any name to be resolved with a remote query such as DNS " +"is a really bad idea. The I can be either a network mask or a plain " +"number, specifying the number of 1's at the left side of the network mask. " +"Thus, a mask of I<24> is equivalent to I<255.255.255.0>. A \"!\" argument " +"before the address specification inverts the sense of the address. The flag " +"B<--src> is an alias for this option. Multiple addresses can be specified, " +"but this will B (when adding with -A), or will " +"cause multiple rules to be deleted (with -D)." msgstr "" -#. type: SS -#: original/man8/ip6tables.8:522 original/man8/iptables.8:510 +#. type: TP +#: original/man8/iptables.8:282 #, no-wrap -msgid "comment" -msgstr "" - -#. type: Plain text -#: original/man8/ip6tables.8:524 original/man8/iptables.8:512 -msgid "Allows you to add comments (up to 256 characters) to any rule." +msgid "[B] B<-d>, B<--destination> I
[BI][B<,>I<...>]" msgstr "" #. type: TP -#: original/man8/ip6tables.8:524 original/man8/iptables.8:512 +#: original/man8/iptables.8:328 #, no-wrap -msgid "B<--comment> I" +msgid "[B] B<-f>, B<--fragment>" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:529 original/man8/iptables.8:517 -msgid "iptables -A INPUT -i eth1 -m comment --comment \"my local LAN\"" +#: original/man8/iptables.8:336 +msgid "" +"This means that the rule only refers to second and further fragments of " +"fragmented packets. Since there is no way to tell the source or destination " +"ports of such a packet (or ICMP type), such a packet will not match any " +"rules which specify them. When the \"!\" argument precedes the \"-f\" flag, " +"the rule will only match head fragments, or unfragmented packets." msgstr "" -#. type: SS -#: original/man8/ip6tables.8:529 original/man8/iptables.8:517 +#. type: SH +#: original/man8/iptables.8:374 #, no-wrap -msgid "connbytes" +msgid "MATCH AND TARGET EXTENSIONS" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:533 original/man8/iptables.8:521 +#: original/man8/iptables.8:386 msgid "" -"Match by how many bytes or packets a connection (or one of the two flows " -"constituting the connection) has transferred so far, or by average bytes per " -"packet." +"Bugs? What's this? ;-) Well, you might want to have a look at " +"http://bugzilla.netfilter.org/" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:535 original/man8/iptables.8:523 -msgid "The counters are 64-bit and are thus not expected to overflow ;)" +#: original/man8/iptables.8:395 +msgid "" +"This B is very similar to ipchains by Rusty Russell. The main " +"difference is that the chains B and B are only traversed for " +"packets coming into the local host and originating from the local host " +"respectively. Hence every packet only passes through one of the three " +"chains (except loopback traffic, which involves both INPUT and OUTPUT " +"chains); previously a forwarded packet would pass through all three." msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:538 original/man8/iptables.8:526 +#: original/man8/iptables.8:399 msgid "" -"The primary use is to detect long-lived downloads and mark them to be " -"scheduled using a lower priority band in traffic control." +"The other main difference is that B<-i> refers to the input interface; B<-o> " +"refers to the output interface, and both are available for packets entering " +"the B chain." msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:541 original/man8/iptables.8:529 +#: original/man8/iptables.8:405 msgid "" -"The transferred bytes per connection can also be viewed through `conntrack " -"-L` and accessed via ctnetlink." +"The various forms of NAT have been separated out; B is a pure " +"packet filter when using the default `filter' table, with optional extension " +"modules. This should simplify much of the previous confusion over the " +"combination of IP masquerading and packet filtering seen previously. So the " +"following options are handled differently:" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:547 original/man8/iptables.8:535 +#: original/man8/iptables.8:409 +#, no-wrap msgid "" -"NOTE that for connections which have no accounting information, the match " -"will always return false. The \"net.netfilter.nf_conntrack_acct\" sysctl " -"flag controls whether B connections will be byte/packet " -"counted. Existing connection flows will not be gaining/losing a/the " -"accounting structure when be sysctl flag is flipped." +" -j MASQ\n" +" -M -S\n" +" -M -L\n" msgstr "" -#. type: TP -#: original/man8/ip6tables.8:547 original/man8/iptables.8:535 -#, no-wrap -msgid "[B] B<--connbytes> I[B<:>I]" +#. type: Plain text +#: original/man8/iptables.8:411 +msgid "There are several other changes in iptables." msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:553 original/man8/iptables.8:541 +#: original/man8/iptables.8:420 msgid "" -"match packets from a connection whose packets/bytes/average packet size is " -"more than FROM and less than TO bytes/packets. if TO is omitted only FROM " -"check is done. \"!\" is used to match packets not falling in the range." +"B(8), B(8), B(8), " +"B(8), B(8), B(8), " +"B(8), B(3)." msgstr "" -#. type: TP -#: original/man8/ip6tables.8:553 original/man8/iptables.8:541 -#, no-wrap -msgid "B<--connbytes-dir> {B|B|B}" +#. type: Plain text +#: original/man8/iptables.8:426 +msgid "" +"The packet-filtering-HOWTO details iptables usage for packet filtering, the " +"NAT-HOWTO details NAT, the netfilter-extensions-HOWTO details the extensions " +"that are not in the standard distribution, and the netfilter-hacking-HOWTO " +"details the netfilter internals." msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:556 original/man8/iptables.8:544 -msgid "which packets to consider" -msgstr "" - -#. type: TP -#: original/man8/ip6tables.8:556 original/man8/iptables.8:544 -#, no-wrap -msgid "B<--connbytes-mode> {B|B|B}" +#: original/man8/iptables.8:432 +msgid "" +"Rusty Russell originally wrote iptables, in early consultation with Michael " +"Neuling." msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:563 original/man8/iptables.8:551 +#: original/man8/iptables.8:442 msgid "" -"whether to check the amount of packets, number of bytes transferred or the " -"average size (in bytes) of all packets received so far. Note that when " -"\"both\" is used together with \"avgpkt\", and data is going (mainly) only " -"in one direction (for example HTTP), the average packet size will be about " -"half of the actual data packets." +"Harald Welte wrote the ULOG and NFQUEUE target, the new libiptc, as well as " +"the TTL, DSCP, ECN matches and targets." msgstr "" +#. .. and did I mention that we are incredibly cool people? +#. .. sexy, too .. +#. .. witty, charming, powerful .. +#. .. and most of all, modest .. #. type: Plain text -#: original/man8/ip6tables.8:566 original/man8/iptables.8:554 -msgid "" -"iptables .. -m connbytes --connbytes 10000:100000 --connbytes-dir both " -"--connbytes-mode bytes ..." -msgstr "" - -#. type: SS -#: original/man8/ip6tables.8:566 original/man8/iptables.8:554 -#, no-wrap -msgid "connlimit" +#: original/man8/iptables.8:452 +msgid "Man page originally written by Herve Eychenne Erv@wallfire.orgE." msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:569 original/man8/iptables.8:557 -msgid "" -"Allows you to restrict the number of parallel connections to a server per " -"client IP address (or client address block)." +#: original/man8/iptables.8:454 +msgid "This manual page applies to iptables 1.4.18." msgstr "" -#. type: TP -#: original/man8/ip6tables.8:569 original/man8/iptables.8:557 +#. type: TH +#: original/man8/iptables-extensions.8:1 #, no-wrap -msgid "B<--connlimit-upto> I" +msgid "iptables-extensions" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:572 original/man8/iptables.8:560 -msgid "Match if the number of existing connections is below or equal I." -msgstr "" - -#. type: TP -#: original/man8/ip6tables.8:572 original/man8/iptables.8:560 -#, no-wrap -msgid "B<--connlimit-above> I" +#: original/man8/iptables-extensions.8:4 +msgid "" +"iptables-extensions \\(em list of extensions in the standard iptables " +"distribution" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:575 original/man8/iptables.8:563 -msgid "Match if the number of existing connections is above I." -msgstr "" - -#. type: TP -#: original/man8/ip6tables.8:575 original/man8/iptables.8:563 -#, no-wrap -msgid "B<--connlimit-mask> I" +#: original/man8/iptables-extensions.8:7 +msgid "" +"B [B<-m> I [I...]] [B<-j> I " +"[I...]" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:580 original/man8/iptables.8:568 +#: original/man8/iptables-extensions.8:10 msgid "" -"Group hosts using the prefix length. For IPv4, this must be a number between " -"(including) 0 and 32. For IPv6, between 0 and 128. If not specified, the " -"maximum prefix length for the applicable protocol is used." +"B [B<-m> I [I...]] [B<-j> I " +"[I...]" msgstr "" -#. type: TP -#: original/man8/ip6tables.8:580 original/man8/iptables.8:568 -#, no-wrap -msgid "B<--connlimit-saddr>" +#. type: Plain text +#: original/man8/iptables-extensions.8:20 +msgid "" +"iptables can use extended packet matching modules with the B<-m> or " +"B<--match> options, followed by the matching module name; after these, " +"various extra command line options become available, depending on the " +"specific module. You can specify multiple extended match modules in one " +"line, and you can use the B<-h> or B<--help> options after the module has " +"been specified to receive help specific to that module. The extended match " +"modules are evaluated in the order they are specified in the rule." msgstr "" +#. @MATCH@ #. type: Plain text -#: original/man8/ip6tables.8:584 original/man8/iptables.8:572 +#: original/man8/iptables-extensions.8:25 msgid "" -"Apply the limit onto the source group. This is the default if " -"--connlimit-daddr is not specified." +"If the B<-p> or B<--protocol> was specified and if and only if an unknown " +"option is encountered, iptables will try load a match module of the same " +"name as the protocol, to try making the option available." msgstr "" -#. type: TP -#: original/man8/ip6tables.8:584 original/man8/iptables.8:572 +#. type: SS +#: original/man8/iptables-extensions.8:25 #, no-wrap -msgid "B<--connlimit-daddr>" +msgid "addrtype" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:587 original/man8/iptables.8:575 -msgid "Apply the limit onto the destination group." +#: original/man8/iptables-extensions.8:30 +msgid "" +"This module matches packets based on their B
Address types " +"are used within the kernel networking stack and categorize addresses into " +"various groups. The exact definition of that group depends on the specific " +"layer three protocol." msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:589 original/man8/ip6tables.8:852 original/man8/ip6tables.8:1390 original/man8/ip6tables.8:1514 original/man8/iptables.8:577 original/man8/iptables.8:800 original/man8/iptables.8:1317 original/man8/iptables.8:1421 -msgid "Examples:" +#: original/man8/iptables-extensions.8:32 +msgid "The following address types are possible:" msgstr "" #. type: TP -#: original/man8/ip6tables.8:589 original/man8/iptables.8:577 +#: original/man8/iptables-extensions.8:32 #, no-wrap -msgid "# allow 2 telnet connections per client host" +msgid "B" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:592 original/man8/iptables.8:580 -msgid "" -"iptables -A INPUT -p tcp --syn --dport 23 -m connlimit --connlimit-above 2 " -"-j REJECT" +#: original/man8/iptables-extensions.8:35 +msgid "an unspecified address (i.e. 0.0.0.0)" msgstr "" #. type: TP -#: original/man8/ip6tables.8:592 original/man8/iptables.8:580 +#: original/man8/iptables-extensions.8:35 #, no-wrap -msgid "# you can also match the other way around:" +msgid "B" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:595 original/man8/iptables.8:583 -msgid "" -"iptables -A INPUT -p tcp --syn --dport 23 -m connlimit --connlimit-upto 2 -j " -"ACCEPT" +#: original/man8/iptables-extensions.8:38 +msgid "an unicast address" msgstr "" #. type: TP -#: original/man8/ip6tables.8:595 original/man8/iptables.8:583 +#: original/man8/iptables-extensions.8:38 #, no-wrap -msgid "" -"# limit the number of parallel HTTP requests to 16 per class C sized source " -"network (24 bit netmask)" +msgid "B" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:600 original/man8/iptables.8:588 -msgid "" -"iptables -p tcp --syn --dport 80 -m connlimit --connlimit-above 16 " -"--connlimit-mask 24 -j REJECT" +#: original/man8/iptables-extensions.8:41 +msgid "a local address" msgstr "" #. type: TP -#: original/man8/ip6tables.8:600 original/man8/iptables.8:588 +#: original/man8/iptables-extensions.8:41 #, no-wrap -msgid "" -"# limit the number of parallel HTTP requests to 16 for the link local " -"network" +msgid "B" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:605 original/man8/iptables.8:593 -msgid "" -"(ipv6) ip6tables -p tcp --syn --dport 80 -s fe80::/64 -m connlimit " -"--connlimit-above 16 --connlimit-mask 64 -j REJECT" +#: original/man8/iptables-extensions.8:44 +msgid "a broadcast address" msgstr "" #. type: TP -#: original/man8/ip6tables.8:605 original/man8/iptables.8:593 +#: original/man8/iptables-extensions.8:44 #, no-wrap -msgid "# Limit the number of connections to a particular host:" +msgid "B" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:609 original/man8/iptables.8:597 -msgid "" -"ip6tables -p tcp --syn --dport 49152:65535 -d 2001:db8::1 -m connlimit " -"--connlimit-above 100 -j REJECT" +#: original/man8/iptables-extensions.8:47 +msgid "an anycast packet" msgstr "" -#. type: SS -#: original/man8/ip6tables.8:609 original/man8/iptables.8:597 +#. type: TP +#: original/man8/iptables-extensions.8:47 #, no-wrap -msgid "connmark" +msgid "B" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:612 original/man8/iptables.8:600 -msgid "" -"This module matches the netfilter mark field associated with a connection " -"(which can be set using the B target below)." +#: original/man8/iptables-extensions.8:50 +msgid "a multicast address" msgstr "" #. type: TP -#: original/man8/ip6tables.8:612 original/man8/ip6tables.8:1023 original/man8/iptables.8:600 original/man8/iptables.8:909 +#: original/man8/iptables-extensions.8:50 #, no-wrap -msgid "[B] B<--mark> I[BI]" +msgid "B" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:616 original/man8/iptables.8:604 -msgid "" -"Matches packets in connections with the given mark value (if a mask is " -"specified, this is logically ANDed with the mark before the comparison)." +#: original/man8/iptables-extensions.8:53 +msgid "a blackhole address" msgstr "" -#. type: SS -#: original/man8/ip6tables.8:616 original/man8/iptables.8:604 +#. type: TP +#: original/man8/iptables-extensions.8:53 #, no-wrap -msgid "conntrack" +msgid "B" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:619 original/man8/iptables.8:607 -msgid "" -"This module, when combined with connection tracking, allows access to the " -"connection tracking state for this packet/connection." +#: original/man8/iptables-extensions.8:56 +msgid "an unreachable address" msgstr "" #. type: TP -#: original/man8/ip6tables.8:619 original/man8/iptables.8:607 +#: original/man8/iptables-extensions.8:56 #, no-wrap -msgid "[B] B<--ctstate> I" +msgid "B" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:623 original/man8/iptables.8:611 -msgid "" -"I is a comma separated list of the connection states to match. " -"Possible states are listed below." +#: original/man8/iptables-extensions.8:59 +msgid "a prohibited address" msgstr "" #. type: TP -#: original/man8/ip6tables.8:623 original/man8/iptables.8:611 +#: original/man8/iptables-extensions.8:59 #, no-wrap -msgid "[B] B<--ctproto> I" +msgid "B" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:626 original/man8/iptables.8:614 -msgid "Layer-4 protocol to match (by number or name)" -msgstr "" - -#. type: TP -#: original/man8/ip6tables.8:626 original/man8/iptables.8:614 -#, no-wrap -msgid "[B] B<--ctorigsrc> I
[BI]" +#: original/man8/iptables-extensions.8:62 original/man8/iptables-extensions.8:65 +msgid "FIXME" msgstr "" #. type: TP -#: original/man8/ip6tables.8:628 original/man8/iptables.8:616 +#: original/man8/iptables-extensions.8:62 #, no-wrap -msgid "[B] B<--ctorigdst> I
[BI]" +msgid "B" msgstr "" #. type: TP -#: original/man8/ip6tables.8:630 original/man8/iptables.8:618 +#: original/man8/iptables-extensions.8:65 #, no-wrap -msgid "[B] B<--ctreplsrc> I
[BI]" +msgid "B" msgstr "" #. type: TP -#: original/man8/ip6tables.8:632 original/man8/iptables.8:620 +#: original/man8/iptables-extensions.8:67 #, no-wrap -msgid "[B] B<--ctrepldst> I
[BI]" +msgid "[B] B<--src-type> I" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:635 original/man8/iptables.8:623 -msgid "Match against original/reply source/destination address" -msgstr "" - -#. type: TP -#: original/man8/ip6tables.8:635 original/man8/iptables.8:623 -#, no-wrap -msgid "[B] B<--ctorigsrcport> I[B<:>I]" +#: original/man8/iptables-extensions.8:70 +msgid "Matches if the source address is of given type" msgstr "" #. type: TP -#: original/man8/ip6tables.8:637 original/man8/iptables.8:625 +#: original/man8/iptables-extensions.8:70 #, no-wrap -msgid "[B] B<--ctorigdstport> I[B<:>I]" +msgid "[B] B<--dst-type> I" msgstr "" -#. type: TP -#: original/man8/ip6tables.8:639 original/man8/iptables.8:627 -#, no-wrap -msgid "[B] B<--ctreplsrcport> I[B<:>I]" +#. type: Plain text +#: original/man8/iptables-extensions.8:73 +msgid "Matches if the destination address is of given type" msgstr "" #. type: TP -#: original/man8/ip6tables.8:641 original/man8/iptables.8:629 +#: original/man8/iptables-extensions.8:73 #, no-wrap -msgid "[B] B<--ctrepldstport> I[B<:>I]" +msgid "B<--limit-iface-in>" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:645 original/man8/iptables.8:633 +#: original/man8/iptables-extensions.8:84 msgid "" -"Match against original/reply source/destination port (TCP/UDP/etc.) or GRE " -"key. Matching against port ranges is only supported in kernel versions " -"above 2.6.38." +"The address type checking can be limited to the interface the packet is " +"coming in. This option is only valid in the B, B and " +"B chains. It cannot be specified with the B<--limit-iface-out> " +"option." msgstr "" #. type: TP -#: original/man8/ip6tables.8:645 original/man8/iptables.8:633 +#: original/man8/iptables-extensions.8:84 #, no-wrap -msgid "[B] B<--ctstatus> I" +msgid "B<--limit-iface-out>" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:649 original/man8/iptables.8:637 +#: original/man8/iptables-extensions.8:95 msgid "" -"I is a comma separated list of the connection statuses to " -"match. Possible statuses are listed below." +"The address type checking can be limited to the interface the packet is " +"going out. This option is only valid in the B, B and " +"B chains. It cannot be specified with the B<--limit-iface-in> " +"option." msgstr "" -#. type: TP -#: original/man8/ip6tables.8:649 original/man8/iptables.8:637 +#. type: SS +#: original/man8/iptables-extensions.8:95 #, no-wrap -msgid "[B] B<--ctexpire> I
]" +#. type: TP +#: original/man8/iptables-extensions.8:1847 +#, no-wrap +msgid "B<--to-destination> [I[B<->I]][B<:>I[B<->I]]" msgstr "" #. type: Plain text -#: original/man8/iptables-save.8:31 +#: original/man8/iptables-extensions.8:1858 msgid "" -"B is used to dump the contents of an IP Table in easily " -"parseable format to STDOUT. Use I/O-redirection provided by your shell to " -"write to a file." +"which can specify a single new destination IP address, an inclusive range of " +"IP addresses, and optionally, a port range (which is only valid if the rule " +"also specifies B<-p tcp> or B<-p udp>). If no port range is specified, then " +"the destination port will never be modified. If no IP address is specified " +"then only the destination port will be modified." msgstr "" #. type: Plain text -#: original/man8/iptables-save.8:48 -msgid "B(8), B(8)" +#: original/man8/iptables-extensions.8:1865 +msgid "" +"In Kernels up to 2.6.10 you can add several --to-destination options. For " +"those kernels, if you specify more than one destination address, either via " +"an address range or multiple --to-destination options, a simple round-robin " +"(one after another in cycle) load balancing takes place between these " +"addresses. Later Kernels (E= 2.6.11-rc1) don't have the ability to NAT " +"to multiple ranges anymore." msgstr "" -#. type: TH -#: original/man8/iptables.8:1 +#. type: TP +#: original/man8/iptables-extensions.8:1865 original/man8/iptables-extensions.8:2145 original/man8/iptables-extensions.8:2176 original/man8/iptables-extensions.8:2299 original/man8/iptables-extensions.8:2387 original/man8/iptables-extensions.8:2456 #, no-wrap -msgid "IPTABLES" +msgid "B<--random>" msgstr "" #. type: Plain text -#: original/man8/iptables.8:27 -msgid "iptables \\(em administration tool for IPv4 packet filtering and NAT" +#: original/man8/iptables-extensions.8:1870 original/man8/iptables-extensions.8:2304 +msgid "" +"If option B<--random> is used then port mapping will be randomized (kernel " +"E= 2.6.22)." msgstr "" -#. type: Plain text -#: original/man8/iptables.8:30 -msgid "" -"B [B<-t> I
] {B<-A>|B<-C>|B<-D>} I " -"I" +#. type: TP +#: original/man8/iptables-extensions.8:1870 original/man8/iptables-extensions.8:2461 +#, no-wrap +msgid "B<--persistent>" msgstr "" #. type: Plain text -#: original/man8/iptables.8:32 +#: original/man8/iptables-extensions.8:1875 original/man8/iptables-extensions.8:2466 msgid "" -"B [B<-t> I
] B<-I> I [I] " -"I" +"Gives a client the same source-/destination-address for each connection. " +"This supersedes the SAME target. Support for persistent mappings is " +"available from 2.6.29-rc2." msgstr "" -#. type: Plain text -#: original/man8/iptables.8:34 -msgid "B [B<-t> I
] B<-R> I" +#. type: SS +#: original/man8/iptables-extensions.8:1875 +#, no-wrap +msgid "DSCP" msgstr "" #. type: Plain text -#: original/man8/iptables.8:36 -msgid "B [B<-t> I
] B<-D> I" +#: original/man8/iptables-extensions.8:1879 +msgid "" +"This target allows to alter the value of the DSCP bits within the TOS header " +"of the IPv4 packet. As this manipulates a packet, it can only be used in " +"the mangle table." msgstr "" -#. type: Plain text -#: original/man8/iptables.8:38 -msgid "B [B<-t> I
] B<-S> [I [I]]" +#. type: TP +#: original/man8/iptables-extensions.8:1879 +#, no-wrap +msgid "B<--set-dscp> I" msgstr "" #. type: Plain text -#: original/man8/iptables.8:40 -msgid "" -"B [B<-t> I
] {B<-F>|B<-L>|B<-Z>} [I [I]] " -"[I]" +#: original/man8/iptables-extensions.8:1882 +msgid "Set the DSCP field to a numerical value (can be decimal or hex)" msgstr "" -#. type: Plain text -#: original/man8/iptables.8:42 -msgid "B [B<-t> I
] B<-N> I" +#. type: TP +#: original/man8/iptables-extensions.8:1882 +#, no-wrap +msgid "B<--set-dscp-class> I" msgstr "" #. type: Plain text -#: original/man8/iptables.8:44 -msgid "B [B<-t> I
] B<-X> [I]" +#: original/man8/iptables-extensions.8:1885 +msgid "Set the DSCP field to a DiffServ class." msgstr "" -#. type: Plain text -#: original/man8/iptables.8:46 -msgid "B [B<-t> I
] B<-P> I" +#. type: SS +#: original/man8/iptables-extensions.8:1885 +#, no-wrap +msgid "ECN (IPv4-specific)" msgstr "" #. type: Plain text -#: original/man8/iptables.8:48 -msgid "B [B<-t> I
] B<-E> I" +#: original/man8/iptables-extensions.8:1888 +msgid "" +"This target allows to selectively work around known ECN blackholes. It can " +"only be used in the mangle table." msgstr "" -#. type: Plain text -#: original/man8/iptables.8:50 -msgid "rule-specification = [I] [I]" +#. type: TP +#: original/man8/iptables-extensions.8:1888 +#, no-wrap +msgid "B<--ecn-tcp-remove>" msgstr "" #. type: Plain text -#: original/man8/iptables.8:52 -msgid "match = B<-m> I [I]" +#: original/man8/iptables-extensions.8:1893 +msgid "" +"Remove all ECN bits from the TCP header. Of course, it can only be used in " +"conjunction with B<-p tcp>." +msgstr "" + +#. type: SS +#: original/man8/iptables-extensions.8:1893 +#, no-wrap +msgid "HL (IPv6-specific)" msgstr "" #. type: Plain text -#: original/man8/iptables.8:54 -msgid "target = B<-j> I [I]" +#: original/man8/iptables-extensions.8:1900 +msgid "" +"This is used to modify the Hop Limit field in IPv6 header. The Hop Limit " +"field is similar to what is known as TTL value in IPv4. Setting or " +"incrementing the Hop Limit field can potentially be very dangerous, so it " +"should be avoided at any cost. This target is only valid in B table." msgstr "" #. type: Plain text -#: original/man8/iptables.8:60 +#: original/man8/iptables-extensions.8:1902 original/man8/iptables-extensions.8:2613 msgid "" -"B is used to set up, maintain, and inspect the tables of IPv4 " -"packet filter rules in the Linux kernel. Several different tables may be " -"defined. Each table contains a number of built-in chains and may also " -"contain user-defined chains." +"B" msgstr "" #. type: TP -#: original/man8/iptables.8:107 +#: original/man8/iptables-extensions.8:1902 #, no-wrap -msgid "B:" +msgid "B<--hl-set> I" msgstr "" #. type: Plain text -#: original/man8/iptables.8:114 -msgid "" -"This table is consulted when a packet that creates a new connection is " -"encountered. It consists of three built-ins: B (for altering " -"packets as soon as they come in), B (for altering locally-generated " -"packets before routing), and B (for altering packets as they " -"are about to go out)." +#: original/man8/iptables-extensions.8:1905 +msgid "Set the Hop Limit to `value'." +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:1905 +#, no-wrap +msgid "B<--hl-dec> I" msgstr "" #. type: Plain text -#: original/man8/iptables.8:147 -msgid "" -"The options that are recognized by B can be divided into several " -"different groups." +#: original/man8/iptables-extensions.8:1908 +msgid "Decrement the Hop Limit `value' times." +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:1908 +#, no-wrap +msgid "B<--hl-inc> I" msgstr "" #. type: Plain text -#: original/man8/iptables.8:153 -msgid "" -"These options specify the desired action to perform. Only one of them can be " -"specified on the command line unless otherwise stated below. For long " -"versions of the command and option names, you need to use only enough " -"letters to ensure that B can differentiate it from all other " -"options." +#: original/man8/iptables-extensions.8:1911 +msgid "Increment the Hop Limit `value' times." +msgstr "" + +#. type: SS +#: original/man8/iptables-extensions.8:1911 +#, no-wrap +msgid "HMARK" msgstr "" #. type: Plain text -#: original/man8/iptables.8:188 +#: original/man8/iptables-extensions.8:1916 msgid "" -"List all rules in the selected chain. If no chain is selected, all chains " -"are listed. Like every other iptables command, it applies to the specified " -"table (filter is the default), so NAT rules get listed by" +"Like MARK, i.e. set the fwmark, but the mark is calculated from hashing " +"packet selector at choice. You have also to specify the mark range and, " +"optionally, the offset to start from. ICMP error messages are inspected and " +"used to calculate the hashing." msgstr "" #. type: Plain text -#: original/man8/iptables.8:190 +#: original/man8/iptables-extensions.8:1918 +msgid "Existing options are:" +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:1918 #, no-wrap -msgid " iptables -t nat -n -L\n" +msgid "B<--hmark-tuple> tuple" msgstr "" #. type: Plain text -#: original/man8/iptables.8:199 +#: original/man8/iptables-extensions.8:1933 +msgid "" +"Possible tuple members are: B meaning source address (IPv4, IPv6 " +"address), B meaning destination address (IPv4, IPv6 address), B " +"meaning source port (TCP, UDP, UDPlite, SCTP, DCCP), B meaning " +"destination port (TCP, UDP, UDPlite, SCTP, DCCP), B meaning Security " +"Parameter Index (AH, ESP), and B meaning the usage of the conntrack " +"tuple instead of the packet selectors." +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:1933 #, no-wrap -msgid " iptables -L -v\n" +msgid "B<--hmark-mod> I 0)>" msgstr "" #. type: Plain text -#: original/man8/iptables.8:205 -msgid "" -"Print all rules in the selected chain. If no chain is selected, all chains " -"are printed like iptables-save. Like every other iptables command, it " -"applies to the specified table (filter is the default)." +#: original/man8/iptables-extensions.8:1936 +msgid "Modulus for hash calculation (to limit the range of possible marks)" +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:1936 +#, no-wrap +msgid "B<--hmark-offset> I" msgstr "" #. type: Plain text -#: original/man8/iptables.8:256 -msgid "" -"The protocol of the rule or of the packet to check. The specified protocol " -"can be one of B, B, B, B, B, B, B or " -"the special keyword \"B\", or it can be a numeric value, representing " -"one of these protocols or a different one. A protocol name from " -"/etc/protocols is also allowed. A \"!\" argument before the protocol " -"inverts the test. The number zero is equivalent to B. \"B\" will " -"match with all protocols and is taken as default when this option is " -"omitted." +#: original/man8/iptables-extensions.8:1939 +msgid "Offset to start marks from." msgstr "" #. type: TP -#: original/man8/iptables.8:256 +#: original/man8/iptables-extensions.8:1939 #, no-wrap -msgid "[B] B<-s>, B<--source> I
[BI][B<,>I<...>]" +msgid "For advanced usage, instead of using --hmark-tuple, you can specify custom" msgstr "" #. type: Plain text -#: original/man8/iptables.8:273 -msgid "" -"Source specification. I
can be either a network name, a hostname, a " -"network IP address (with BI), or a plain IP address. Hostnames will " -"be resolved once only, before the rule is submitted to the kernel. Please " -"note that specifying any name to be resolved with a remote query such as DNS " -"is a really bad idea. The I can be either a network mask or a plain " -"number, specifying the number of 1's at the left side of the network mask. " -"Thus, a mask of I<24> is equivalent to I<255.255.255.0>. A \"!\" argument " -"before the address specification inverts the sense of the address. The flag " -"B<--src> is an alias for this option. Multiple addresses can be specified, " -"but this will B (when adding with -A), or will " -"cause multiple rules to be deleted (with -D)." +#: original/man8/iptables-extensions.8:1942 +msgid "prefixes and masks:" msgstr "" #. type: TP -#: original/man8/iptables.8:273 +#: original/man8/iptables-extensions.8:1942 #, no-wrap -msgid "[B] B<-d>, B<--destination> I
[BI][B<,>I<...>]" +msgid "B<--hmark-src-prefix> I" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:1945 +msgid "The source address mask in CIDR notation." msgstr "" #. type: TP -#: original/man8/iptables.8:312 +#: original/man8/iptables-extensions.8:1945 #, no-wrap -msgid "[B] B<-f>, B<--fragment>" +msgid "B<--hmark-dst-prefix> I" msgstr "" #. type: Plain text -#: original/man8/iptables.8:320 -msgid "" -"This means that the rule only refers to second and further fragments of " -"fragmented packets. Since there is no way to tell the source or destination " -"ports of such a packet (or ICMP type), such a packet will not match any " -"rules which specify them. When the \"!\" argument precedes the \"-f\" flag, " -"the rule will only match head fragments, or unfragmented packets." +#: original/man8/iptables-extensions.8:1948 +msgid "The destination address mask in CIDR notation." +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:1948 +#, no-wrap +msgid "B<--hmark-sport-mask> I" msgstr "" #. type: Plain text -#: original/man8/iptables.8:368 -msgid "" -"iptables can use extended packet matching modules with the B<-m> or " -"B<--match> options, followed by the matching module name; after these, " -"various extra command line options become available, depending on the " -"specific module. You can specify multiple extended match modules in one " -"line, and you can use the B<-h> or B<--help> options after the module has " -"been specified to receive help specific to that module." +#: original/man8/iptables-extensions.8:1951 +msgid "A 16 bit source port mask in hexadecimal." +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:1951 +#, no-wrap +msgid "B<--hmark-dport-mask> I" msgstr "" -#. @MATCH@ #. type: Plain text -#: original/man8/iptables.8:373 -msgid "" -"If the B<-p> or B<--protocol> was specified and if and only if an unknown " -"option is encountered, iptables will try load a match module of the same " -"name as the protocol, to try making the option available." +#: original/man8/iptables-extensions.8:1954 +msgid "A 16 bit destination port mask in hexadecimal." +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:1954 +#, no-wrap +msgid "B<--hmark-spi-mask> I" msgstr "" #. type: Plain text -#: original/man8/iptables.8:445 -msgid "This module matches the SPIs in Authentication header of IPsec packets." +#: original/man8/iptables-extensions.8:1957 +msgid "A 32 bit field with spi mask." msgstr "" -#. type: SS -#: original/man8/iptables.8:825 +#. type: TP +#: original/man8/iptables-extensions.8:1957 #, no-wrap -msgid "icmp" +msgid "B<--hmark-proto-mask> I" msgstr "" #. type: Plain text -#: original/man8/iptables.8:828 -msgid "" -"This extension can be used if `--protocol icmp' is specified. It provides " -"the following option:" +#: original/man8/iptables-extensions.8:1960 +msgid "An 8 bit field with layer 4 protocol number." msgstr "" #. type: TP -#: original/man8/iptables.8:828 +#: original/man8/iptables-extensions.8:1960 #, no-wrap -msgid "[B] B<--icmp-type> {I[BI]|I}" +msgid "B<--hmark-rnd> I" msgstr "" #. type: Plain text -#: original/man8/iptables.8:832 -msgid "" -"This allows specification of the ICMP type, which can be a numeric ICMP " -"type, type/code pair, or one of the ICMP type names shown by the command" +#: original/man8/iptables-extensions.8:1963 +msgid "A 32 bit random custom value to feed hash calculation." msgstr "" #. type: Plain text -#: original/man8/iptables.8:834 +#: original/man8/iptables-extensions.8:1965 +msgid "I" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:1969 #, no-wrap -msgid " iptables -p icmp -h\n" +msgid "" +"iptables -t mangle -A PREROUTING -m conntrack --ctstate NEW\n" +" -j HMARK --hmark-tuple ct,src,dst,proto --hmark-offset 10000\n" +"--hmark-mod 10 --hmark-rnd 0xfeedcafe\n" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:1972 +msgid "" +"iptables -t mangle -A PREROUTING -j HMARK --hmark-offset 10000 --hmark-tuple " +"src,dst,proto --hmark-mod 10 --hmark-rnd 0xdeafbeef" msgstr "" #. type: SS -#: original/man8/iptables.8:969 +#: original/man8/iptables-extensions.8:1972 #, no-wrap -msgid "osf" +msgid "IDLETIMER" msgstr "" #. type: Plain text -#: original/man8/iptables.8:973 +#: original/man8/iptables-extensions.8:1981 msgid "" -"The osf module does passive operating system fingerprinting. This modules " -"compares some data (Window Size, MSS, options and their order, TTL, DF, and " -"others) from packets with the SYN bit set." +"This target can be used to identify when interfaces have been idle for a " +"certain period of time. Timers are identified by labels and are created " +"when a rule is set with a new label. The rules also take a timeout value " +"(in seconds) as an option. If more than one rule uses the same timer label, " +"the timer will be restarted whenever any of the rules get a hit. One entry " +"for each timer is created in sysfs. This attribute contains the timer " +"remaining for the timer to expire. The attributes are located under the " +"xt_idletimer class:" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:1983 +msgid "/sys/class/xt_idletimer/timers/ElabelE" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:1986 +msgid "" +"When the timer expires, the target module sends a sysfs notification to the " +"userspace, which can then decide what to do (eg. disconnect to save power)." msgstr "" #. type: TP -#: original/man8/iptables.8:973 +#: original/man8/iptables-extensions.8:1986 #, no-wrap -msgid "[B] B<--genre> I" +msgid "B<--timeout> I" msgstr "" #. type: Plain text -#: original/man8/iptables.8:976 -msgid "Match an operating system genre by using a passive fingerprinting." +#: original/man8/iptables-extensions.8:1989 +msgid "This is the time in seconds that will trigger the notification." msgstr "" #. type: TP -#: original/man8/iptables.8:976 +#: original/man8/iptables-extensions.8:1989 #, no-wrap -msgid "B<--ttl> I" +msgid "B<--label> I" msgstr "" #. type: Plain text -#: original/man8/iptables.8:980 +#: original/man8/iptables-extensions.8:1993 msgid "" -"Do additional TTL checks on the packet to determine the operating system. " -"I can be one of the following values:" +"This is a unique identifier for the timer. The maximum length for the label " +"string is 27 characters." +msgstr "" + +#. type: SS +#: original/man8/iptables-extensions.8:1993 +#, no-wrap +msgid "LED" msgstr "" #. type: Plain text -#: original/man8/iptables.8:983 +#: original/man8/iptables-extensions.8:1999 msgid "" -"0 - True IP address and fingerprint TTL comparison. This generally works for " -"LANs." +"This creates an LED-trigger that can then be attached to system indicator " +"lights, to blink or illuminate them when certain packets pass through the " +"system. One example might be to light up an LED for a few minutes every time " +"an SSH connection is made to the local machine. The following options " +"control the trigger behavior:" +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:1999 +#, no-wrap +msgid "B<--led-trigger-id> I" msgstr "" #. type: Plain text -#: original/man8/iptables.8:986 +#: original/man8/iptables-extensions.8:2003 msgid "" -"1 - Check if the IP header's TTL is less than the fingerprint one. Works for " -"globally-routable addresses." +"This is the name given to the LED trigger. The actual name of the trigger " +"will be prefixed with \"netfilter-\"." +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:2003 +#, no-wrap +msgid "B<--led-delay> I" msgstr "" #. type: Plain text -#: original/man8/iptables.8:988 -msgid "2 - Do not compare the TTL at all." +#: original/man8/iptables-extensions.8:2011 +msgid "" +"This indicates how long (in milliseconds) the LED should be left illuminated " +"when a packet arrives before being switched off again. The default is 0 " +"(blink as fast as possible.) The special value I can be given to leave " +"the LED on permanently once activated. (In this case the trigger will need " +"to be manually detached and reattached to the LED device to switch it off " +"again.)" msgstr "" #. type: TP -#: original/man8/iptables.8:988 +#: original/man8/iptables-extensions.8:2011 #, no-wrap -msgid "B<--log> I" +msgid "B<--led-always-blink>" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2016 +msgid "" +"Always make the LED blink on packet arrival, even if the LED is already on. " +"This allows notification of new packets even with long delay values (which " +"otherwise would result in a silent prolonging of the delay time.)" +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:2018 +#, no-wrap +msgid "Create an LED trigger for incoming SSH traffic:" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2021 +msgid "iptables -A INPUT -p tcp --dport 22 -j LED --led-trigger-id ssh" +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:2021 +#, no-wrap +msgid "Then attach the new trigger to an LED:" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2024 +msgid "echo netfilter-ssh E/sys/class/leds/I/trigger" +msgstr "" + +#. type: SS +#: original/man8/iptables-extensions.8:2024 +#, no-wrap +msgid "LOG (IPv6-specific)" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2036 +msgid "" +"Turn on kernel logging of matching packets. When this option is set for a " +"rule, the Linux kernel will print some information on all matching packets " +"(like most IPv6 IPv6-header fields) via the kernel log (where it can be read " +"with I or I(8)). This is a \"non-terminating target\", " +"i.e. rule traversal continues at the next rule. So if you want to LOG the " +"packets you refuse, use two separate rules with the same matching criteria, " +"first using target LOG then DROP (or REJECT)." +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:2036 original/man8/iptables-extensions.8:2071 +#, no-wrap +msgid "B<--log-level> I" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2042 original/man8/iptables-extensions.8:2077 +msgid "" +"Level of logging, which can be (system-specific) numeric or a mnemonic. " +"Possible values are (in decreasing order of priority): B, B, " +"B, B, B, B, B or B." +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:2042 original/man8/iptables-extensions.8:2077 +#, no-wrap +msgid "B<--log-prefix> I" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2046 original/man8/iptables-extensions.8:2081 +msgid "" +"Prefix log messages with the specified prefix; up to 29 letters long, and " +"useful for distinguishing messages in the logs." +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:2046 original/man8/iptables-extensions.8:2081 +#, no-wrap +msgid "B<--log-tcp-sequence>" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2050 original/man8/iptables-extensions.8:2085 +msgid "" +"Log TCP sequence numbers. This is a security risk if the log is readable by " +"users." +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:2050 original/man8/iptables-extensions.8:2085 +#, no-wrap +msgid "B<--log-tcp-options>" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2053 original/man8/iptables-extensions.8:2088 +msgid "Log options from the TCP packet header." +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:2053 original/man8/iptables-extensions.8:2088 +#, no-wrap +msgid "B<--log-ip-options>" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2056 +msgid "Log options from the IPv6 packet header." +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:2056 original/man8/iptables-extensions.8:2091 +#, no-wrap +msgid "B<--log-uid>" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2059 original/man8/iptables-extensions.8:2094 +msgid "Log the userid of the process which generated the packet." +msgstr "" + +#. type: SS +#: original/man8/iptables-extensions.8:2059 +#, no-wrap +msgid "LOG (IPv4-specific)" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2071 +msgid "" +"Turn on kernel logging of matching packets. When this option is set for a " +"rule, the Linux kernel will print some information on all matching packets " +"(like most IP header fields) via the kernel log (where it can be read with " +"I or I(8)). This is a \"non-terminating target\", i.e. rule " +"traversal continues at the next rule. So if you want to LOG the packets you " +"refuse, use two separate rules with the same matching criteria, first using " +"target LOG then DROP (or REJECT)." +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2091 +msgid "Log options from the IP packet header." +msgstr "" + +#. type: SS +#: original/man8/iptables-extensions.8:2094 +#, no-wrap +msgid "MARK" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2100 +msgid "" +"This target is used to set the Netfilter mark value associated with the " +"packet. It can, for example, be used in conjunction with routing based on " +"fwmark (needs iproute2). If you plan on doing so, note that the mark needs " +"to be set in the PREROUTING chain of the mangle table to affect routing. " +"The mark field is 32 bits wide." +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2104 +msgid "" +"Zeroes out the bits given by I and XORs I into the packet mark " +"(\"nfmark\"). If I is omitted, 0xFFFFFFFF is assumed." +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2108 +msgid "" +"Zeroes out the bits given by I and ORs I into the packet " +"mark. If I is omitted, 0xFFFFFFFF is assumed." +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2110 original/man8/iptables-extensions.8:2545 +msgid "The following mnemonics are available:" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2114 +msgid "" +"Binary AND the nfmark with I. (Mnemonic for B<--set-xmark " +"0/>I, where I is the binary negation of I.)" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2118 +msgid "" +"Binary OR the nfmark with I. (Mnemonic for B<--set-xmark> " +"IBI.)" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2122 +msgid "" +"Binary XOR the nfmark with I. (Mnemonic for B<--set-xmark> " +"IB.)" +msgstr "" + +#. type: SS +#: original/man8/iptables-extensions.8:2122 +#, no-wrap +msgid "MASQUERADE (IPv6-specific)" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2136 +msgid "" +"This target is only valid in the B table, in the B chain. " +"It should only be used with dynamically assigned IPv6 (dialup) connections: " +"if you have a static IP address, you should use the SNAT target. " +"Masquerading is equivalent to specifying a mapping to the IP address of the " +"interface the packet is going out, but also has the effect that connections " +"are I when the interface goes down. This is the correct behavior " +"when the next dialup is unlikely to have the same interface address (and " +"hence any established connections are lost anyway)." +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:2136 original/man8/iptables-extensions.8:2167 original/man8/iptables-extensions.8:2291 +#, no-wrap +msgid "B<--to-ports> I[B<->I]" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2145 original/man8/iptables-extensions.8:2176 +msgid "" +"This specifies a range of source ports to use, overriding the default " +"B source port-selection heuristics (see above). This is only valid if " +"the rule also specifies B<-p tcp> or B<-p udp>." +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2151 +msgid "" +"Randomize source port mapping If option B<--random> is used then port " +"mapping will be randomized." +msgstr "" + +#. type: SS +#: original/man8/iptables-extensions.8:2153 +#, no-wrap +msgid "MASQUERADE (IPv4-specific)" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2167 +msgid "" +"This target is only valid in the B table, in the B chain. " +"It should only be used with dynamically assigned IP (dialup) connections: " +"if you have a static IP address, you should use the SNAT target. " +"Masquerading is equivalent to specifying a mapping to the IP address of the " +"interface the packet is going out, but also has the effect that connections " +"are I when the interface goes down. This is the correct behavior " +"when the next dialup is unlikely to have the same interface address (and " +"hence any established connections are lost anyway)." +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2182 +msgid "" +"Randomize source port mapping If option B<--random> is used then port " +"mapping will be randomized (kernel E= 2.6.21)." +msgstr "" + +#. type: SS +#: original/man8/iptables-extensions.8:2184 +#, no-wrap +msgid "MIRROR (IPv4-specific)" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2197 +msgid "" +"This is an experimental demonstration target which inverts the source and " +"destination fields in the IP header and retransmits the packet. It is only " +"valid in the B, B and B chains, and user-defined " +"chains which are only called from those chains. Note that the outgoing " +"packets are B seen by any packet filtering chains, connection tracking " +"or NAT, to avoid loops and other problems." +msgstr "" + +#. type: SS +#: original/man8/iptables-extensions.8:2197 +#, no-wrap +msgid "NETMAP (IPv4-specific)" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2202 +msgid "" +"This target allows you to statically map a whole network of addresses onto " +"another network of addresses. It can only be used from rules in the B " +"table." +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:2202 +#, no-wrap +msgid "B<--to> I
[BI]" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2207 +msgid "" +"Network address to map to. The resulting address will be constructed in the " +"following way: All 'one' bits in the mask are filled in from the new " +"`address'. All bits that are zero in the mask are filled in from the " +"original address." +msgstr "" + +#. type: SS +#: original/man8/iptables-extensions.8:2207 +#, no-wrap +msgid "NFLOG" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2217 +msgid "" +"This target provides logging of matching packets. When this target is set " +"for a rule, the Linux kernel will pass the packet to the loaded logging " +"backend to log the packet. This is usually used in combination with " +"nfnetlink_log as logging backend, which will multicast the packet through a " +"I socket to the specified multicast group. One or more userspace " +"processes may subscribe to the group to receive the packets. Like LOG, this " +"is a non-terminating target, i.e. rule traversal continues at the next rule." +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:2217 +#, no-wrap +msgid "B<--nflog-group> I" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2221 +msgid "" +"The netlink group (0 - 2^16-1) to which packets are (only applicable for " +"nfnetlink_log). The default value is 0." +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:2221 +#, no-wrap +msgid "B<--nflog-prefix> I" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2225 +msgid "" +"A prefix string to include in the log message, up to 64 characters long, " +"useful for distinguishing messages in the logs." +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:2225 +#, no-wrap +msgid "B<--nflog-range> I" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2230 +msgid "" +"The number of bytes to be copied to userspace (only applicable for " +"nfnetlink_log). nfnetlink_log instances may specify their own range, this " +"option overrides it." +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:2230 +#, no-wrap +msgid "B<--nflog-threshold> I" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2237 +msgid "" +"Number of packets to queue inside the kernel before sending them to " +"userspace (only applicable for nfnetlink_log). Higher values result in less " +"overhead per packet, but increase delay until the packets reach " +"userspace. The default value is 1." +msgstr "" + +#. type: SS +#: original/man8/iptables-extensions.8:2237 +#, no-wrap +msgid "NFQUEUE" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2247 +msgid "" +"This target is an extension of the QUEUE target. As opposed to QUEUE, it " +"allows you to put a packet into any specific queue, identified by its 16-bit " +"queue number. It can only be used with Kernel versions 2.6.14 or later, " +"since it requires the B kernel support. The " +"B option was added in Linux 2.6.31, B in " +"2.6.39." +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:2247 +#, no-wrap +msgid "B<--queue-num> I" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2250 +msgid "" +"This specifies the QUEUE number to use. Valid queue numbers are 0 to " +"65535. The default value is 0." +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:2251 +#, no-wrap +msgid "B<--queue-balance> IB<:>I" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2257 +msgid "" +"This specifies a range of queues to use. Packets are then balanced across " +"the given queues. This is useful for multicore systems: start multiple " +"instances of the userspace program on queues x, x+1, .. x+n and use " +"\"--queue-balance IB<:>I\". Packets belonging to the same " +"connection are put into the same nfqueue." +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:2258 +#, no-wrap +msgid "B<--queue-bypass>" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2263 +msgid "" +"By default, if no userspace program is listening on an NFQUEUE, then all " +"packets that are to be queued are dropped. When this option is used, the " +"NFQUEUE rule is silently bypassed instead. The packet will move on to the " +"next rule." +msgstr "" + +#. type: SS +#: original/man8/iptables-extensions.8:2263 +#, no-wrap +msgid "NOTRACK" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2267 +msgid "" +"This target disables connection tracking for all packets matching that " +"rule. It is obsoleted by -j CT --notrack. Like CT, NOTRACK can only be used " +"in the B table." +msgstr "" + +#. type: SS +#: original/man8/iptables-extensions.8:2267 +#, no-wrap +msgid "RATEEST" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2270 +msgid "" +"The RATEEST target collects statistics, performs rate estimation calculation " +"and saves the results for later evaluation using the B match." +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:2270 +#, no-wrap +msgid "B<--rateest-name> I" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2274 +msgid "" +"Count matched packets into the pool referred to by I, which is freely " +"choosable." +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:2274 +#, no-wrap +msgid "B<--rateest-interval> I{B|B|B}" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2277 +msgid "Rate measurement interval, in seconds, milliseconds or microseconds." +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:2277 +#, no-wrap +msgid "B<--rateest-ewmalog> I" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2280 +msgid "Rate measurement averaging time constant." +msgstr "" + +#. type: SS +#: original/man8/iptables-extensions.8:2280 +#, no-wrap +msgid "REDIRECT (IPv4-specific)" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2291 +msgid "" +"This target is only valid in the B table, in the B and " +"B chains, and user-defined chains which are only called from those " +"chains. It redirects the packet to the machine itself by changing the " +"destination IP to the primary address of the incoming interface " +"(locally-generated packets are mapped to the 127.0.0.1 address)." +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2299 +msgid "" +"This specifies a destination port or range of ports to use: without this, " +"the destination port is never altered. This is only valid if the rule also " +"specifies B<-p tcp> or B<-p udp>." +msgstr "" + +#. type: SS +#: original/man8/iptables-extensions.8:2306 +#, no-wrap +msgid "REJECT (IPv6-specific)" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2319 original/man8/iptables-extensions.8:2353 +msgid "" +"This is used to send back an error packet in response to the matched packet: " +"otherwise it is equivalent to B so it is a terminating TARGET, ending " +"rule traversal. This target is only valid in the B, B and " +"B chains, and user-defined chains which are only called from those " +"chains. The following option controls the nature of the error packet " +"returned:" +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:2319 original/man8/iptables-extensions.8:2353 +#, no-wrap +msgid "B<--reject-with> I" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2340 +msgid "" +"The type given can be B, B, " +"B, B, B, " +"B, B or B which return " +"the appropriate ICMPv6 error message (B is the " +"default). Finally, the option B can be used on rules which only " +"match the TCP protocol: this causes a TCP RST packet to be sent back. This " +"is mainly useful for blocking I (113/tcp) probes which frequently " +"occur when sending mail to broken mail hosts (which won't accept your mail " +"otherwise). B can only be used with kernel versions 2.6.14 or " +"later." +msgstr "" + +#. type: SS +#: original/man8/iptables-extensions.8:2340 +#, no-wrap +msgid "REJECT (IPv4-specific)" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2371 +msgid "" +"The type given can be B, B, " +"B, B, B, " +"B or B (*) which return the " +"appropriate ICMP error message (B is the default). The " +"option B can be used on rules which only match the TCP protocol: " +"this causes a TCP RST packet to be sent back. This is mainly useful for " +"blocking I (113/tcp) probes which frequently occur when sending mail " +"to broken mail hosts (which won't accept your mail otherwise)." msgstr "" #. type: Plain text -#: original/man8/iptables.8:992 +#: original/man8/iptables-extensions.8:2373 msgid "" -"Log determined genres into dmesg even if they do not match the desired one. " -"I can be one of the following values:" -msgstr "" - -#. type: Plain text -#: original/man8/iptables.8:994 -msgid "0 - Log all matched or unknown signatures" +"(*) Using icmp-admin-prohibited with kernels that do not support it will " +"result in a plain DROP instead of REJECT" msgstr "" -#. type: Plain text -#: original/man8/iptables.8:996 -msgid "1 - Log only the first one" +#. type: SS +#: original/man8/iptables-extensions.8:2373 +#, no-wrap +msgid "SAME (IPv4-specific)" msgstr "" #. type: Plain text -#: original/man8/iptables.8:998 -msgid "2 - Log all known matched signatures" +#: original/man8/iptables-extensions.8:2377 +msgid "" +"Similar to SNAT/DNAT depending on chain: it takes a range of addresses " +"(`--to 1.2.3.4-1.2.3.7') and gives a client the same " +"source-/destination-address for each connection." msgstr "" #. type: Plain text -#: original/man8/iptables.8:1000 -msgid "You may find something like this in syslog:" +#: original/man8/iptables-extensions.8:2379 +msgid "N.B.: The DNAT target's B<--persistent> option replaced the SAME target." msgstr "" -#. type: Plain text -#: original/man8/iptables.8:1003 -msgid "" -"Windows [2000:SP3:Windows XP Pro SP1, 2000 SP3]: 11.22.33.55:4024 -E " -"11.22.33.44:139 hops=3 Linux [2.5-2.6:] : 1.2.3.4:42624 -E 1.2.3.5:22 " -"hops=4" +#. type: TP +#: original/man8/iptables-extensions.8:2379 +#, no-wrap +msgid "B<--to> I[B<->I]" msgstr "" #. type: Plain text -#: original/man8/iptables.8:1006 +#: original/man8/iptables-extensions.8:2383 msgid "" -"OS fingerprints are loadable using the B program. To load " -"fingerprints from a file, use:" -msgstr "" - -#. type: Plain text -#: original/man8/iptables.8:1008 -msgid "B" +"Addresses to map source to. May be specified more than once for multiple " +"ranges." msgstr "" -#. type: Plain text -#: original/man8/iptables.8:1010 -msgid "To remove them again," +#. type: TP +#: original/man8/iptables-extensions.8:2383 +#, no-wrap +msgid "B<--nodst>" msgstr "" #. type: Plain text -#: original/man8/iptables.8:1012 -msgid "B" +#: original/man8/iptables-extensions.8:2387 +msgid "" +"Don't use the destination-ip in the calculations when selecting the new " +"source-ip" msgstr "" #. type: Plain text -#: original/man8/iptables.8:1015 +#: original/man8/iptables-extensions.8:2391 msgid "" -"The fingerprint database can be downlaoded from " -"http://www.openbsd.org/cgi-bin/cvsweb/src/etc/pf.os ." +"Port mapping will be forcibly randomized to avoid attacks based on port " +"prediction (kernel E= 2.6.21)." msgstr "" #. type: SS -#: original/man8/iptables.8:1241 +#: original/man8/iptables-extensions.8:2391 #, no-wrap -msgid "realm" +msgid "SECMARK" msgstr "" #. type: Plain text -#: original/man8/iptables.8:1244 +#: original/man8/iptables-extensions.8:2400 msgid "" -"This matches the routing realm. Routing realms are used in complex routing " -"setups involving dynamic routing protocols like BGP." +"This is used to set the security mark value associated with the packet for " +"use by security subsystems such as SELinux. It is valid in the B " +"table (for backwards compatibility with older kernels, it is also valid in " +"the B table). The mark is 32 bits wide." msgstr "" #. type: TP -#: original/man8/iptables.8:1244 +#: original/man8/iptables-extensions.8:2400 #, no-wrap -msgid "[B] B<--realm> I[BI]" -msgstr "" - -#. type: Plain text -#: original/man8/iptables.8:1249 -msgid "" -"Matches a given realm number (and optionally mask). If not a number, value " -"can be a named realm from /etc/iproute2/rt_realms (mask can not be used in " -"that case)." +msgid "B<--selctx> I" msgstr "" #. type: SS -#: original/man8/iptables.8:1680 +#: original/man8/iptables-extensions.8:2402 #, no-wrap -msgid "ttl" +msgid "SET" msgstr "" #. type: Plain text -#: original/man8/iptables.8:1682 -msgid "This module matches the time to live field in the IP header." +#: original/man8/iptables-extensions.8:2405 +msgid "" +"This module adds and/or deletes entries from IP sets which can be defined by " +"ipset(8)." msgstr "" #. type: TP -#: original/man8/iptables.8:1682 +#: original/man8/iptables-extensions.8:2405 #, no-wrap -msgid "[B] B<--ttl-eq> I" +msgid "B<--add-set> I I[B<,>I...]" msgstr "" #. type: Plain text -#: original/man8/iptables.8:1685 -msgid "Matches the given TTL value." +#: original/man8/iptables-extensions.8:2408 +msgid "add the address(es)/port(s) of the packet to the set" msgstr "" #. type: TP -#: original/man8/iptables.8:1685 +#: original/man8/iptables-extensions.8:2408 #, no-wrap -msgid "B<--ttl-gt> I" +msgid "B<--del-set> I I[B<,>I...]" msgstr "" #. type: Plain text -#: original/man8/iptables.8:1688 -msgid "Matches if TTL is greater than the given TTL value." +#: original/man8/iptables-extensions.8:2411 +msgid "delete the address(es)/port(s) of the packet from the set" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2417 +msgid "" +"where I(s) are B and/or B specifications and there can be no " +"more than six of them." msgstr "" #. type: TP -#: original/man8/iptables.8:1688 +#: original/man8/iptables-extensions.8:2417 #, no-wrap -msgid "B<--ttl-lt> I" +msgid "B<--timeout> I" msgstr "" #. type: Plain text -#: original/man8/iptables.8:1691 -msgid "Matches if TTL is less than the given TTL value." +#: original/man8/iptables-extensions.8:2421 +msgid "" +"when adding an entry, the timeout value to use instead of the default one " +"from the set definition" msgstr "" -#. type: SS -#: original/man8/iptables.8:1836 +#. type: TP +#: original/man8/iptables-extensions.8:2421 #, no-wrap -msgid "unclean" +msgid "B<--exist>" msgstr "" #. type: Plain text -#: original/man8/iptables.8:1839 +#: original/man8/iptables-extensions.8:2425 msgid "" -"This module takes no options, but attempts to match packets which seem " -"malformed or unusual. This is regarded as experimental." +"when adding an entry if it already exists, reset the timeout value to the " +"specified one or to the default from the set definition" msgstr "" -#. @TARGET@ #. type: Plain text -#: original/man8/iptables.8:1843 +#: original/man8/iptables-extensions.8:2428 msgid "" -"iptables can use extended target modules: the following are included in the " -"standard distribution." +"Use of -j SET requires that ipset kernel support is provided, which, for " +"standard kernels, is the case since Linux 2.6.39." msgstr "" #. type: SS -#: original/man8/iptables.8:1873 +#: original/man8/iptables-extensions.8:2428 #, no-wrap -msgid "CLUSTERIP" +msgid "SNAT (IPv4-specific)" msgstr "" #. type: Plain text -#: original/man8/iptables.8:1878 +#: original/man8/iptables-extensions.8:2437 msgid "" -"This module allows you to configure a simple cluster of nodes that share a " -"certain IP and MAC address without an explicit load balancer in front of " -"them. Connections are statically distributed between the nodes in this " -"cluster." +"This target is only valid in the B table, in the B chain. " +"It specifies that the source address of the packet should be modified (and " +"all future packets in this connection will also be mangled), and rules " +"should cease being examined. It takes one type of option:" msgstr "" #. type: TP -#: original/man8/iptables.8:1878 +#: original/man8/iptables-extensions.8:2437 #, no-wrap -msgid "B<--new>" +msgid "B<--to-source> [I[B<->I]][B<:>I[B<->I]]" msgstr "" #. type: Plain text -#: original/man8/iptables.8:1882 +#: original/man8/iptables-extensions.8:2449 msgid "" -"Create a new ClusterIP. You always have to set this on the first rule for a " -"given ClusterIP." +"which can specify a single new source IP address, an inclusive range of IP " +"addresses, and optionally, a port range (which is only valid if the rule " +"also specifies B<-p tcp> or B<-p udp>). If no port range is specified, then " +"source ports below 512 will be mapped to other ports below 512: those " +"between 512 and 1023 inclusive will be mapped to ports below 1024, and other " +"ports will be mapped to 1024 or above. Where possible, no port alteration " +"will occur." msgstr "" -#. type: TP -#: original/man8/iptables.8:1882 -#, no-wrap -msgid "B<--hashmode> I" +#. type: Plain text +#: original/man8/iptables-extensions.8:2456 +msgid "" +"In Kernels up to 2.6.10, you can add several --to-source options. For those " +"kernels, if you specify more than one source address, either via an address " +"range or multiple --to-source options, a simple round-robin (one after " +"another in cycle) takes place between these addresses. Later Kernels " +"(E= 2.6.11-rc1) don't have the ability to NAT to multiple ranges " +"anymore." msgstr "" #. type: Plain text -#: original/man8/iptables.8:1886 +#: original/man8/iptables-extensions.8:2461 msgid "" -"Specify the hashing mode. Has to be one of B, " -"B, B." +"If option B<--random> is used then port mapping will be randomized (kernel " +"E= 2.6.21)." msgstr "" -#. type: TP -#: original/man8/iptables.8:1886 +#. type: SS +#: original/man8/iptables-extensions.8:2466 #, no-wrap -msgid "B<--clustermac> I" +msgid "TCPMSS" msgstr "" #. type: Plain text -#: original/man8/iptables.8:1889 -msgid "Specify the ClusterIP MAC address. Has to be a link-layer multicast address" -msgstr "" - -#. type: TP -#: original/man8/iptables.8:1889 -#, no-wrap -msgid "B<--total-nodes> I" +#: original/man8/iptables-extensions.8:2473 +msgid "" +"This target allows to alter the MSS value of TCP SYN packets, to control the " +"maximum size for that connection (usually limiting it to your outgoing " +"interface's MTU minus 40 for IPv4 or 60 for IPv6, respectively). Of course, " +"it can only be used in conjunction with B<-p tcp>." msgstr "" #. type: Plain text -#: original/man8/iptables.8:1892 -msgid "Number of total nodes within this cluster." +#: original/man8/iptables-extensions.8:2480 +msgid "" +"This target is used to overcome criminally braindead ISPs or servers which " +"block \"ICMP Fragmentation Needed\" or \"ICMPv6 Packet Too Big\" packets. " +"The symptoms of this problem are that everything works fine from your Linux " +"firewall/router, but machines behind it can never exchange large packets:" msgstr "" -#. type: TP -#: original/man8/iptables.8:1892 +#. type: IP +#: original/man8/iptables-extensions.8:2480 #, no-wrap -msgid "B<--local-node> I" +msgid "1." msgstr "" #. type: Plain text -#: original/man8/iptables.8:1895 -msgid "Local node number within this cluster." +#: original/man8/iptables-extensions.8:2482 +msgid "Web browsers connect, then hang with no data received." msgstr "" -#. type: TP -#: original/man8/iptables.8:1895 +#. type: IP +#: original/man8/iptables-extensions.8:2482 #, no-wrap -msgid "B<--hash-init> I" +msgid "2." msgstr "" #. type: Plain text -#: original/man8/iptables.8:1898 -msgid "Specify the random seed used for hash initialization." +#: original/man8/iptables-extensions.8:2484 +msgid "Small mail works fine, but large emails hang." msgstr "" -#. type: SS -#: original/man8/iptables.8:1997 +#. type: IP +#: original/man8/iptables-extensions.8:2484 #, no-wrap -msgid "DNAT" +msgid "3." msgstr "" #. type: Plain text -#: original/man8/iptables.8:2009 -msgid "" -"This target is only valid in the B table, in the B and " -"B chains, and user-defined chains which are only called from those " -"chains. It specifies that the destination address of the packet should be " -"modified (and all future packets in this connection will also be mangled), " -"and rules should cease being examined. It takes one type of option:" -msgstr "" - -#. type: TP -#: original/man8/iptables.8:2009 -#, no-wrap -msgid "B<--to-destination> [I[B<->I]][B<:>I[B<->I]]" +#: original/man8/iptables-extensions.8:2486 +msgid "ssh works fine, but scp hangs after initial handshaking." msgstr "" #. type: Plain text -#: original/man8/iptables.8:2020 +#: original/man8/iptables-extensions.8:2489 msgid "" -"which can specify a single new destination IP address, an inclusive range of " -"IP addresses, and optionally, a port range (which is only valid if the rule " -"also specifies B<-p tcp> or B<-p udp>). If no port range is specified, then " -"the destination port will never be modified. If no IP address is specified " -"then only the destination port will be modified." +"Workaround: activate this option and add a rule to your firewall " +"configuration like:" msgstr "" #. type: Plain text -#: original/man8/iptables.8:2027 +#: original/man8/iptables-extensions.8:2492 +#, no-wrap msgid "" -"In Kernels up to 2.6.10 you can add several --to-destination options. For " -"those kernels, if you specify more than one destination address, either via " -"an address range or multiple --to-destination options, a simple round-robin " -"(one after another in cycle) load balancing takes place between these " -"addresses. Later Kernels (E= 2.6.11-rc1) don't have the ability to NAT " -"to multiple ranges anymore." +" iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN\n" +" -j TCPMSS --clamp-mss-to-pmtu\n" msgstr "" #. type: TP -#: original/man8/iptables.8:2027 original/man8/iptables.8:2159 original/man8/iptables.8:2284 original/man8/iptables.8:2338 original/man8/iptables.8:2407 +#: original/man8/iptables-extensions.8:2492 #, no-wrap -msgid "B<--random>" +msgid "B<--set-mss> I" msgstr "" #. type: Plain text -#: original/man8/iptables.8:2032 original/man8/iptables.8:2289 +#: original/man8/iptables-extensions.8:2497 msgid "" -"If option B<--random> is used then port mapping will be randomized (kernel " -"E= 2.6.22)." +"Explicitly sets MSS option to specified value. If the MSS of the packet is " +"already lower than I, it will B be increased (from Linux 2.6.25 " +"onwards) to avoid more problems with hosts relying on a proper MSS." msgstr "" #. type: TP -#: original/man8/iptables.8:2032 original/man8/iptables.8:2412 +#: original/man8/iptables-extensions.8:2497 #, no-wrap -msgid "B<--persistent>" +msgid "B<--clamp-mss-to-pmtu>" msgstr "" #. type: Plain text -#: original/man8/iptables.8:2037 original/man8/iptables.8:2417 +#: original/man8/iptables-extensions.8:2506 msgid "" -"Gives a client the same source-/destination-address for each connection. " -"This supersedes the SAME target. Support for persistent mappings is " -"available from 2.6.29-rc2." -msgstr "" - -#. type: SS -#: original/man8/iptables.8:2047 -#, no-wrap -msgid "ECN" +"Automatically clamp MSS value to (path_MTU - 40 for IPv4; -60 for IPv6). " +"This may not function as desired where asymmetric routes with differing path " +"MTU exist \\(em the kernel uses the path MTU which it would use to send " +"packets from itself to the source and destination IP addresses. Prior to " +"Linux 2.6.25, only the path MTU to the destination IP address was considered " +"by this option; subsequent kernels also consider the path MTU to the source " +"IP address." msgstr "" #. type: Plain text -#: original/man8/iptables.8:2050 -msgid "" -"This target allows to selectively work around known ECN blackholes. It can " -"only be used in the mangle table." +#: original/man8/iptables-extensions.8:2508 +msgid "These options are mutually exclusive." msgstr "" -#. type: TP -#: original/man8/iptables.8:2050 +#. type: SS +#: original/man8/iptables-extensions.8:2508 #, no-wrap -msgid "B<--ecn-tcp-remove>" -msgstr "" - -#. type: Plain text -#: original/man8/iptables.8:2055 -msgid "" -"Remove all ECN bits from the TCP header. Of course, it can only be used in " -"conjunction with B<-p tcp>." +msgid "TCPOPTSTRIP" msgstr "" #. type: Plain text -#: original/man8/iptables.8:2088 +#: original/man8/iptables-extensions.8:2511 msgid "" -"Turn on kernel logging of matching packets. When this option is set for a " -"rule, the Linux kernel will print some information on all matching packets " -"(like most IP header fields) via the kernel log (where it can be read with " -"I or I(8)). This is a \"non-terminating target\", i.e. rule " -"traversal continues at the next rule. So if you want to LOG the packets you " -"refuse, use two separate rules with the same matching criteria, first using " -"target LOG then DROP (or REJECT)." -msgstr "" - -#. type: Plain text -#: original/man8/iptables.8:2105 -msgid "Log options from the IP packet header." +"This target will strip TCP options off a TCP packet. (It will actually " +"replace them by NO-OPs.) As such, you will need to add the B<-p tcp> " +"parameters." msgstr "" -#. type: SS -#: original/man8/iptables.8:2136 +#. type: TP +#: original/man8/iptables-extensions.8:2511 #, no-wrap -msgid "MASQUERADE" +msgid "B<--strip-options> I
" -msgstr "B[-c] [-t table]" +msgstr "B [B<-M> I] [B<-c>] [B<-t> I
" #. type: Plain text #: original/man8/ip6tables-save.8:31 @@ -225,10 +276,9 @@ msgstr "" #. type: TP #: original/man8/ip6tables-save.8:31 original/man8/iptables-save.8:31 -#, fuzzy, no-wrap -#| msgid "B<--modprobe=command>" +#, no-wrap msgid "B<-M> I" -msgstr "B<--modprobe=command>" +msgstr "B<-M> I" #. type: Plain text #: original/man8/ip6tables-save.8:35 original/man8/iptables-save.8:35 @@ -245,10 +295,9 @@ msgstr "全てのパケットカウンタとバイトカウンタの現在の値 #. type: TP #: original/man8/ip6tables-save.8:38 original/man8/iptables-save.8:38 -#, fuzzy, no-wrap -#| msgid "B<-t>, B<--table> B" +#, no-wrap msgid "B<-t>, B<--table> I" -msgstr "B<-t>, B<--table> B" +msgstr "B<-t>, B<--table> I" #. type: Plain text #: original/man8/ip6tables-save.8:42 original/man8/iptables-save.8:42 @@ -272,98 +321,73 @@ msgstr "IP6TABLES" #. type: TH #: original/man8/ip6tables.8:1 original/man8/iptables.8:1 +#: original/man8/iptables-extensions.8:1 #, no-wrap -msgid "iptables 1.4.13" +msgid "iptables 1.4.18" msgstr "" #. type: Plain text #: original/man8/ip6tables.8:29 -#, fuzzy -#| msgid "ip6tables - IPv6 packet filter administration" msgid "ip6tables \\(em IPv6 packet filter administration" -msgstr "ip6tables - IPv6 パケットフィルタを管理する" +msgstr "ip6tables \\(em IPv6 パケットフィルタを管理する" #. type: Plain text #: original/man8/ip6tables.8:32 -#, fuzzy -#| msgid "Bchain rule-specification [options]" msgid "" "B [B<-t> I
] {B<-A>|B<-C>|B<-D>} I [I]" -msgstr "Bチェイン ルールの詳細 [オプション]" +msgstr "B [B<-t> I<テーブル>] {B<-A>|B<-C>|B<-D>} I<チェイン ルールの詳細> [I<オプション...>]" #. type: Plain text #: original/man8/ip6tables.8:35 -#, fuzzy -#| msgid "" -#| "Bchain [rulenum] rule-specification [options]" msgid "" "B [B<-t> I
] B<-I> I [I] I [I]" -msgstr "" -"Bチェイン [ルール番号] ルールの詳細 [オプション]" +msgstr "B [B<-t> I<テーブル>] B<-I> I<チェイン> [I<ルール番号>] I<ルールの詳細> [I<オプション...>]" #. type: Plain text #: original/man8/ip6tables.8:38 -#, fuzzy -#| msgid "" -#| "Bchain rulenum rule-specification [options]" msgid "" "B [B<-t> I
] B<-R> I " "[I]" -msgstr "" -"Bチェイン ルール番号 ルールの詳細 [オプション]" +msgstr "B [B<-t> I<テーブル>] B<-R> I<チェイン ルール番号 ルールの詳細> [I<オプション...>]" #. type: Plain text #: original/man8/ip6tables.8:41 -#, fuzzy -#| msgid "Bchain rulenum [options]" msgid "B [B<-t> I
] B<-D> I [I]" -msgstr "Bチェイン ルール番号 [オプション]" +msgstr "B [B<-t> I<テーブル>] B<-D> I<チェイン ルール番号> [I<オプション...>]" #. type: Plain text #: original/man8/ip6tables.8:43 -#, fuzzy -#| msgid "Bchain rulenum [options]" msgid "B [B<-t> I
] B<-S> [I [I]]" -msgstr "Bチェイン ルール番号 [オプション]" +msgstr "B [B<-t> I<テーブル>] B<-S> [I<チェイン> [I<ルール番号>]]" #. type: Plain text #: original/man8/ip6tables.8:46 -#, fuzzy -#| msgid "Bchain rulenum [options]" msgid "" "B [B<-t> I
] {B<-F>|B<-L>|B<-Z>} [I [I]] " "[I]" -msgstr "Bチェイン ルール番号 [オプション]" +msgstr "B [B<-t> I<テーブル>] {B<-F>|B<-L>|B<-Z>} [I<チェイン> [I<ルール番号>]] [I<オプション...>]" #. type: Plain text #: original/man8/ip6tables.8:48 -#, fuzzy -#| msgid "Bchain" msgid "B [B<-t> I
] B<-N> I" -msgstr "Bチェイン" +msgstr "B [B<-t> I<テーブル>] B<-N> I<チェイン>" #. type: Plain text #: original/man8/ip6tables.8:50 -#, fuzzy -#| msgid "B[chain]" msgid "B [B<-t> I
] B<-X> [I]" -msgstr "B[チェイン]" +msgstr "B [B<-t> I<テーブル>] B<-X> [I<チェイン>]" #. type: Plain text #: original/man8/ip6tables.8:53 -#, fuzzy -#| msgid "Bchain target [options]" msgid "B [B<-t> I
] B<-P> I [I]" -msgstr "Bチェイン ターゲット [オプション]" +msgstr "B [B<-t> I<テーブル>] B<-P> I<チェイン ターゲット> [I<オプション...>]" #. type: Plain text #: original/man8/ip6tables.8:55 -#, fuzzy -#| msgid "Bold-chain-name new-chain-name" msgid "B [B<-t> I
] B<-E> I" -msgstr "B旧チェイン名 新チェイン名" +msgstr "B [B<-t> I<テーブル>] B<-E> I<旧チェイン名 新チェイン名>" #. type: Plain text #: original/man8/ip6tables.8:61 @@ -460,9 +484,14 @@ msgstr "テーブル" #. type: Plain text #: original/man8/ip6tables.8:93 original/man8/iptables.8:92 +#, fuzzy +#| msgid "" +#| "There are currently three independent tables (which tables are present at " +#| "any time depends on the kernel configuration options and which modules " +#| "are present)." msgid "" -"There are currently three independent tables (which tables are present at " -"any time depends on the kernel configuration options and which modules are " +"There are currently five independent tables (which tables are present at any " +"time depends on the kernel configuration options and which modules are " "present)." msgstr "" "現在のところ 3 つの独立なテーブルが存在する (ある時点でどのテーブルが存在する" @@ -520,13 +549,41 @@ msgstr "" "組み込み済みチェインが含まれる。" #. type: TP -#: original/man8/ip6tables.8:108 original/man8/iptables.8:114 +#: original/man8/ip6tables.8:108 original/man8/iptables.8:107 +#, no-wrap +msgid "B:" +msgstr "B:" + +#. type: Plain text +#: original/man8/ip6tables.8:115 +#, fuzzy +#| msgid "" +#| "This table is consulted when a packet that creates a new connection is " +#| "encountered. It consists of three built-ins: B (for altering " +#| "packets as soon as they come in), B (for altering locally-" +#| "generated packets before routing), and B (for altering " +#| "packets as they are about to go out)." +msgid "" +"This table is consulted when a packet that creates a new connection is " +"encountered. It consists of three built-ins: B (for altering " +"packets as soon as they come in), B (for altering locally-generated " +"packets before routing), and B (for altering packets as they " +"are about to go out). Available since kernel 3.7." +msgstr "" +"このテーブルは新しい接続を開くようなパケットに対して参照される。 これには " +"B (パケットが入ってきた場合、すぐにそのパケットを変換するための" +"チェイン)・ B (ローカルで生成されたパケットをルーティングの前に変換す" +"るためのチェイン)・ B (パケットが出て行くときに変換するための" +"チェイン) という 3 つの組み込み済みチェインが含まれる。" + +#. type: TP +#: original/man8/ip6tables.8:115 original/man8/iptables.8:114 #, no-wrap msgid "B:" msgstr "B:" #. type: Plain text -#: original/man8/ip6tables.8:118 original/man8/iptables.8:124 +#: original/man8/ip6tables.8:125 original/man8/iptables.8:124 msgid "" "This table is used for specialized packet alteration. Until kernel 2.4.17 " "it had two built-in chains: B (for altering incoming packets " @@ -546,13 +603,13 @@ msgstr "" "ためのチェイン)・ という 3 つの組み込み済みチェインもサポートされる。" #. type: TP -#: original/man8/ip6tables.8:118 original/man8/iptables.8:124 +#: original/man8/ip6tables.8:125 original/man8/iptables.8:124 #, no-wrap msgid "B:" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:126 original/man8/iptables.8:132 +#: original/man8/ip6tables.8:133 original/man8/iptables.8:132 msgid "" "This table is used mainly for configuring exemptions from connection " "tracking in combination with the NOTRACK target. It registers at the " @@ -563,13 +620,13 @@ msgid "" msgstr "" #. type: TP -#: original/man8/ip6tables.8:126 original/man8/iptables.8:132 +#: original/man8/ip6tables.8:133 original/man8/iptables.8:132 #, no-wrap msgid "B:" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:137 original/man8/iptables.8:143 +#: original/man8/ip6tables.8:144 original/man8/iptables.8:143 msgid "" "This table is used for Mandatory Access Control (MAC) networking rules, such " "as those enabled by the B and B targets. Mandatory " @@ -583,27 +640,27 @@ msgid "" msgstr "" #. type: SH -#: original/man8/ip6tables.8:138 original/man8/iptables.8:144 +#: original/man8/ip6tables.8:145 original/man8/iptables.8:144 #: original/man8/iptables-apply.8:23 #, no-wrap msgid "OPTIONS" msgstr "オプション" #. type: Plain text -#: original/man8/ip6tables.8:141 +#: original/man8/ip6tables.8:148 msgid "" "The options that are recognized by B can be divided into several " "different groups." msgstr "B で使えるオプションは、いくつかのグループに分けられる。" #. type: SS -#: original/man8/ip6tables.8:141 original/man8/iptables.8:147 +#: original/man8/ip6tables.8:148 original/man8/iptables.8:147 #, no-wrap msgid "COMMANDS" msgstr "コマンド" #. type: Plain text -#: original/man8/ip6tables.8:147 +#: original/man8/ip6tables.8:154 msgid "" "These options specify the specific action to perform. Only one of them can " "be specified on the command line unless otherwise specified below. For all " @@ -617,7 +674,7 @@ msgstr "" "ン名と区別できる範囲で (文字を省略して) 指定することもできる。" #. type: TP -#: original/man8/ip6tables.8:147 original/man8/ip6tables.8:230 +#: original/man8/ip6tables.8:154 original/man8/ip6tables.8:237 #: original/man8/iptables.8:153 #, fuzzy, no-wrap #| msgid "B<-A, --append >I" @@ -625,7 +682,7 @@ msgid "B<-A>, B<--append> I" msgstr "B<-A, --append >I" #. type: Plain text -#: original/man8/ip6tables.8:152 original/man8/ip6tables.8:235 +#: original/man8/ip6tables.8:159 original/man8/ip6tables.8:242 #: original/man8/iptables.8:158 msgid "" "Append one or more rules to the end of the selected chain. When the source " @@ -637,14 +694,14 @@ msgstr "" "場合は、可能なアドレスの組合せそれぞれに対してルールが追加される。" #. type: TP -#: original/man8/ip6tables.8:152 original/man8/iptables.8:158 +#: original/man8/ip6tables.8:159 original/man8/iptables.8:158 #, fuzzy, no-wrap #| msgid "B<-A, --append >I" msgid "B<-C>, B<--check> I" msgstr "B<-A, --append >I" #. type: Plain text -#: original/man8/ip6tables.8:158 original/man8/iptables.8:164 +#: original/man8/ip6tables.8:165 original/man8/iptables.8:164 msgid "" "Check whether a rule matching the specification does exist in the selected " "chain. This command uses the same logic as B<-D> to find a matching entry, " @@ -653,21 +710,21 @@ msgid "" msgstr "" #. type: TP -#: original/man8/ip6tables.8:158 original/man8/iptables.8:164 +#: original/man8/ip6tables.8:165 original/man8/iptables.8:164 #, fuzzy, no-wrap #| msgid "B<-D, --delete >I" msgid "B<-D>, B<--delete> I" msgstr "B<-D, --delete >I" #. type: TP -#: original/man8/ip6tables.8:161 original/man8/iptables.8:167 +#: original/man8/ip6tables.8:168 original/man8/iptables.8:167 #, fuzzy, no-wrap #| msgid "B<-D, --delete >I" msgid "B<-D>, B<--delete> I" msgstr "B<-D, --delete >I" #. type: Plain text -#: original/man8/ip6tables.8:166 original/man8/iptables.8:172 +#: original/man8/ip6tables.8:173 original/man8/iptables.8:172 msgid "" "Delete one or more rules from the selected chain. There are two versions of " "this command: the rule can be specified as a number in the chain (starting " @@ -678,14 +735,14 @@ msgstr "" "マッチするルールを指定する場合である。" #. type: TP -#: original/man8/ip6tables.8:166 original/man8/iptables.8:172 +#: original/man8/ip6tables.8:173 original/man8/iptables.8:172 #, fuzzy, no-wrap #| msgid "B<-I, --insert >I [I] I" msgid "B<-I>, B<--insert> I [I] I" msgstr "B<-I, --insert >I<チェイン> [I<ルール番号>] I<ルールの詳細>" #. type: Plain text -#: original/man8/ip6tables.8:172 original/man8/iptables.8:178 +#: original/man8/ip6tables.8:179 original/man8/iptables.8:178 msgid "" "Insert one or more rules in the selected chain as the given rule number. " "So, if the rule number is 1, the rule or rules are inserted at the head of " @@ -696,14 +753,14 @@ msgstr "" "されない場合のデフォルトでもある。" #. type: TP -#: original/man8/ip6tables.8:172 original/man8/iptables.8:178 +#: original/man8/ip6tables.8:179 original/man8/iptables.8:178 #, fuzzy, no-wrap #| msgid "B<-R, --replace >I" msgid "B<-R>, B<--replace> I" msgstr "B<-R, --replace >I" #. type: Plain text -#: original/man8/ip6tables.8:177 original/man8/iptables.8:183 +#: original/man8/ip6tables.8:184 original/man8/iptables.8:183 msgid "" "Replace a rule in the selected chain. If the source and/or destination " "names resolve to multiple addresses, the command will fail. Rules are " @@ -714,14 +771,14 @@ msgstr "" "このコマンドは失敗する。ルール番号は 1 からはじまる。" #. type: TP -#: original/man8/ip6tables.8:177 original/man8/iptables.8:183 +#: original/man8/ip6tables.8:184 original/man8/iptables.8:183 #, fuzzy, no-wrap #| msgid "B<-L, --list >[I]" msgid "B<-L>, B<--list> [I]" msgstr "B<-L, --list >[I]" #. type: Plain text -#: original/man8/ip6tables.8:182 +#: original/man8/ip6tables.8:189 #, fuzzy #| msgid "" #| "List all rules in the selected chain. If no chain is selected, all " @@ -738,7 +795,7 @@ msgstr "" "ルールを表示するには以下のようにする。" #. type: Plain text -#: original/man8/ip6tables.8:189 original/man8/iptables.8:197 +#: original/man8/ip6tables.8:196 original/man8/iptables.8:197 msgid "" "Please note that it is often used with the B<-n> option, in order to avoid " "long reverse DNS lookups. It is legal to specify the B<-Z> (zero) option as " @@ -754,20 +811,20 @@ msgstr "" "実際のルールそのものは表示されない。" #. type: Plain text -#: original/man8/ip6tables.8:191 +#: original/man8/ip6tables.8:198 #, no-wrap msgid " ip6tables -L -v\n" msgstr " ip6tables -L -v\n" #. type: TP -#: original/man8/ip6tables.8:192 original/man8/iptables.8:200 +#: original/man8/ip6tables.8:199 original/man8/iptables.8:200 #, fuzzy, no-wrap #| msgid "B<-L, --list >[I]" msgid "B<-S>, B<--list-rules> [I]" msgstr "B<-L, --list >[I]" #. type: Plain text -#: original/man8/ip6tables.8:197 +#: original/man8/ip6tables.8:204 #, fuzzy #| msgid "" #| "List all rules in the selected chain. If no chain is selected, all " @@ -784,14 +841,14 @@ msgstr "" "ルールを表示するには以下のようにする。" #. type: TP -#: original/man8/ip6tables.8:197 original/man8/iptables.8:205 +#: original/man8/ip6tables.8:204 original/man8/iptables.8:205 #, fuzzy, no-wrap #| msgid "B<-F, --flush >[I]" msgid "B<-F>, B<--flush> [I]" msgstr "B<-F, --flush >[I]" #. type: Plain text -#: original/man8/ip6tables.8:201 original/man8/iptables.8:209 +#: original/man8/ip6tables.8:208 original/man8/iptables.8:209 msgid "" "Flush the selected chain (all the chains in the table if none is given). " "This is equivalent to deleting all the rules one by one." @@ -801,14 +858,14 @@ msgstr "" "同じである。" #. type: TP -#: original/man8/ip6tables.8:201 original/man8/iptables.8:209 +#: original/man8/ip6tables.8:208 original/man8/iptables.8:209 #, fuzzy, no-wrap #| msgid "B<-Z, --zero >[I]" msgid "B<-Z>, B<--zero> [I [I]]" msgstr "B<-Z, --zero >[I]" #. type: Plain text -#: original/man8/ip6tables.8:209 original/man8/iptables.8:217 +#: original/man8/ip6tables.8:216 original/man8/iptables.8:217 #, fuzzy #| msgid "" #| "Zero the packet and byte counters in all chains. It is legal to specify " @@ -825,14 +882,14 @@ msgstr "" "することもできる (上記を参照)。" #. type: TP -#: original/man8/ip6tables.8:209 original/man8/iptables.8:217 +#: original/man8/ip6tables.8:216 original/man8/iptables.8:217 #, fuzzy, no-wrap #| msgid "B<-N, --new-chain >I" msgid "B<-N>, B<--new-chain> I" msgstr "B<-N, --new-chain >I" #. type: Plain text -#: original/man8/ip6tables.8:213 original/man8/iptables.8:221 +#: original/man8/ip6tables.8:220 original/man8/iptables.8:221 msgid "" "Create a new user-defined chain by the given name. There must be no target " "of that name already." @@ -841,14 +898,14 @@ msgstr "" "してはならない。" #. type: TP -#: original/man8/ip6tables.8:213 original/man8/iptables.8:221 +#: original/man8/ip6tables.8:220 original/man8/iptables.8:221 #, fuzzy, no-wrap #| msgid "B<-X, --delete-chain >[I]" msgid "B<-X>, B<--delete-chain> [I]" msgstr "B<-X, --delete-chain >[I]" #. type: Plain text -#: original/man8/ip6tables.8:220 original/man8/iptables.8:228 +#: original/man8/ip6tables.8:227 original/man8/iptables.8:228 #, fuzzy #| msgid "" #| "Delete the optional user-defined chain specified. There must be no " @@ -868,14 +925,14 @@ msgstr "" "ブルにあるチェインのうち 組み込み済みチェインでないものを全て削除する。" #. type: TP -#: original/man8/ip6tables.8:220 original/man8/iptables.8:228 +#: original/man8/ip6tables.8:227 original/man8/iptables.8:228 #, fuzzy, no-wrap #| msgid "B<-P, --policy >I" msgid "B<-P>, B<--policy> I" msgstr "B<-P, --policy >I" #. type: Plain text -#: original/man8/ip6tables.8:226 original/man8/iptables.8:234 +#: original/man8/ip6tables.8:233 original/man8/iptables.8:234 msgid "" "Set the policy for the chain to the given target. See the section " "B for the legal targets. Only built-in (non-user-defined) chains " @@ -888,14 +945,14 @@ msgstr "" "ユーザー定義チェインも ポリシーのターゲットに設定することはできない。" #. type: TP -#: original/man8/ip6tables.8:226 original/man8/iptables.8:234 +#: original/man8/ip6tables.8:233 original/man8/iptables.8:234 #, fuzzy, no-wrap #| msgid "B<-E, --rename-chain >I" msgid "B<-E>, B<--rename-chain> I" msgstr "B<-E, --rename-chain >I" #. type: Plain text -#: original/man8/ip6tables.8:230 original/man8/iptables.8:238 +#: original/man8/ip6tables.8:237 original/man8/iptables.8:238 msgid "" "Rename the user specified chain to the user supplied name. This is " "cosmetic, and has no effect on the structure of the table." @@ -904,24 +961,24 @@ msgstr "" "テーブルの構造には何も影響しない。" #. type: TP -#: original/man8/ip6tables.8:235 original/man8/iptables.8:238 +#: original/man8/ip6tables.8:242 original/man8/iptables.8:238 #, no-wrap msgid "B<-h>" msgstr "B<-h>" #. type: Plain text -#: original/man8/ip6tables.8:239 original/man8/iptables.8:242 +#: original/man8/ip6tables.8:246 original/man8/iptables.8:242 msgid "Help. Give a (currently very brief) description of the command syntax." msgstr "ヘルプ。 (今のところはとても簡単な) コマンド書式の説明を表示する。" #. type: SS -#: original/man8/ip6tables.8:239 original/man8/iptables.8:242 +#: original/man8/ip6tables.8:246 original/man8/iptables.8:242 #, no-wrap msgid "PARAMETERS" msgstr "パラメータ" #. type: Plain text -#: original/man8/ip6tables.8:242 original/man8/iptables.8:245 +#: original/man8/ip6tables.8:249 original/man8/iptables.8:245 msgid "" "The following parameters make up a rule specification (as used in the add, " "delete, insert, replace and append commands)." @@ -930,14 +987,42 @@ msgstr "" "て) ルールの仕様を決める。" #. type: TP -#: original/man8/ip6tables.8:242 original/man8/iptables.8:245 +#: original/man8/ip6tables.8:249 original/man8/iptables.8:245 +#, fuzzy, no-wrap +#| msgid "B<-c>, B<--counters>" +msgid "B<-4>, B<--ipv4>" +msgstr "B<-c>, B<--counters>" + +#. type: Plain text +#: original/man8/ip6tables.8:255 +msgid "" +"If a rule using the B<-4> option is inserted with (and only with) ip6tables-" +"restore, it will be silently ignored. Any other uses will throw an error. " +"This option allows to put both IPv4 and IPv6 rules in a single rule file for " +"use with both iptables-restore and ip6tables-restore." +msgstr "" + +#. type: TP +#: original/man8/ip6tables.8:255 original/man8/iptables.8:248 +#, fuzzy, no-wrap +#| msgid "B<-c>, B<--counters>" +msgid "B<-6>, B<--ipv6>" +msgstr "B<-c>, B<--counters>" + +#. type: Plain text +#: original/man8/ip6tables.8:258 +msgid "This option has no effect in ip6tables and ip6tables-restore." +msgstr "" + +#. type: TP +#: original/man8/ip6tables.8:258 original/man8/iptables.8:254 #, fuzzy, no-wrap #| msgid "B<-p, --protocol >[!] I" msgid "[B] B<-p>, B<--protocol> I" msgstr "B<-p, --protocol >[!] I" #. type: Plain text -#: original/man8/ip6tables.8:260 +#: original/man8/ip6tables.8:276 #, fuzzy #| msgid "" #| "The protocol of the rule or of the packet to check. The specified " @@ -969,14 +1054,14 @@ msgstr "" "プションが省略された際のデフォルトである。" #. type: TP -#: original/man8/ip6tables.8:260 +#: original/man8/ip6tables.8:276 #, fuzzy, no-wrap #| msgid "B<-s, --source >[!] I
[/I]" msgid "[B] B<-s>, B<--source> I
[BI]" msgstr "B<-s, --source >[!] I
[/I]" #. type: Plain text -#: original/man8/ip6tables.8:277 +#: original/man8/ip6tables.8:293 #, fuzzy #| msgid "" #| "Source specification. I
can be either a network name, a " @@ -1010,14 +1095,14 @@ msgstr "" "ションの別名である。" #. type: TP -#: original/man8/ip6tables.8:277 +#: original/man8/ip6tables.8:293 #, fuzzy, no-wrap #| msgid "B<-d, --destination >[!] I
[/I]" msgid "[B] B<-d>, B<--destination> I
[BI]" msgstr "B<-d, --destination >[!] I
[/I]" #. type: Plain text -#: original/man8/ip6tables.8:283 original/man8/iptables.8:279 +#: original/man8/ip6tables.8:299 original/man8/iptables.8:288 msgid "" "Destination specification. See the description of the B<-s> (source) flag " "for a detailed description of the syntax. The flag B<--dst> is an alias for " @@ -1027,14 +1112,31 @@ msgstr "" "すること。 フラグ B<--dst> は、このオプションの別名である。" #. type: TP -#: original/man8/ip6tables.8:283 original/man8/iptables.8:279 +#: original/man8/ip6tables.8:299 original/man8/iptables.8:288 +#, fuzzy, no-wrap +#| msgid "B<-L, --list >[I]" +msgid "B<-m>, B<--match> I" +msgstr "B<-L, --list >[I]" + +#. type: Plain text +#: original/man8/ip6tables.8:306 original/man8/iptables.8:295 +msgid "" +"Specifies a match to use, that is, an extension module that tests for a " +"specific property. The set of matches make up the condition under which a " +"target is invoked. Matches are evaluated first to last as specified on the " +"command line and work in short-circuit fashion, i.e. if one extension yields " +"false, evaluation will stop." +msgstr "" + +#. type: TP +#: original/man8/ip6tables.8:306 original/man8/iptables.8:295 #, fuzzy, no-wrap #| msgid "B<-j, --jump >I" msgid "B<-j>, B<--jump> I" msgstr "B<-j, --jump >I" #. type: Plain text -#: original/man8/ip6tables.8:294 original/man8/iptables.8:290 +#: original/man8/ip6tables.8:317 original/man8/iptables.8:306 #, fuzzy #| msgid "" #| "This specifies the target of the rule; i.e., what to do if the packet " @@ -1062,14 +1164,14 @@ msgstr "" "加算される。" #. type: TP -#: original/man8/ip6tables.8:294 original/man8/iptables.8:290 +#: original/man8/ip6tables.8:317 original/man8/iptables.8:306 #, fuzzy, no-wrap #| msgid "B<-L, --list >[I]" msgid "B<-g>, B<--goto> I" msgstr "B<-L, --list >[I]" #. type: Plain text -#: original/man8/ip6tables.8:300 original/man8/iptables.8:296 +#: original/man8/ip6tables.8:323 original/man8/iptables.8:312 msgid "" "This specifies that the processing should continue in a user specified " "chain. Unlike the --jump option return will not continue processing in this " @@ -1077,14 +1179,14 @@ msgid "" msgstr "" #. type: TP -#: original/man8/ip6tables.8:300 original/man8/iptables.8:296 +#: original/man8/ip6tables.8:323 original/man8/iptables.8:312 #, fuzzy, no-wrap #| msgid "B<-i, --in-interface >[!] I" msgid "[B] B<-i>, B<--in-interface> I" msgstr "B<-i, --in-interface >[!] I" #. type: Plain text -#: original/man8/ip6tables.8:308 original/man8/iptables.8:304 +#: original/man8/ip6tables.8:331 original/man8/iptables.8:320 #, fuzzy #| msgid "" #| "Name of an interface via which a packet is going to be received (only for " @@ -1108,14 +1210,14 @@ msgstr "" "任意のインターフェース名にマッチする。" #. type: TP -#: original/man8/ip6tables.8:308 original/man8/iptables.8:304 +#: original/man8/ip6tables.8:331 original/man8/iptables.8:320 #, fuzzy, no-wrap #| msgid "B<-o, --out-interface >[!] I" msgid "[B] B<-o>, B<--out-interface> I" msgstr "B<-o, --out-interface >[!] I" #. type: Plain text -#: original/man8/ip6tables.8:325 original/man8/iptables.8:312 +#: original/man8/ip6tables.8:348 original/man8/iptables.8:328 msgid "" "Name of an interface via which a packet is going to be sent (for packets " "entering the B, B and B chains). When the \"!" @@ -1132,14 +1234,14 @@ msgstr "" "る。" #. type: TP -#: original/man8/ip6tables.8:325 original/man8/iptables.8:320 +#: original/man8/ip6tables.8:348 original/man8/iptables.8:336 #, fuzzy, no-wrap #| msgid "B<-c, --set-counters >I" msgid "B<-c>, B<--set-counters> I" msgstr "B<-c, --set-counters >I" #. type: Plain text -#: original/man8/ip6tables.8:330 original/man8/iptables.8:325 +#: original/man8/ip6tables.8:353 original/man8/iptables.8:341 #, fuzzy #| msgid "" #| "This enables the administrator to initialize the packet and byte counters " @@ -1152,26 +1254,18 @@ msgstr "" "者はパケットカウンタとバイトカウンタを 初期化することができる。" #. type: SS -#: original/man8/ip6tables.8:330 original/man8/iptables.8:325 +#: original/man8/ip6tables.8:353 original/man8/iptables.8:341 #, no-wrap msgid "OTHER OPTIONS" msgstr "その他のオプション" #. type: Plain text -#: original/man8/ip6tables.8:332 original/man8/iptables.8:327 +#: original/man8/ip6tables.8:355 original/man8/iptables.8:343 msgid "The following additional options can be specified:" msgstr "その他に以下のオプションを指定することができる:" -#. type: TP -#: original/man8/ip6tables.8:332 original/man8/iptables.8:327 -#: original/man1/iptables-xml.1:38 -#, fuzzy, no-wrap -#| msgid "B<-v, --verbose>" -msgid "B<-v>, B<--verbose>" -msgstr "B<-v, --verbose>" - #. type: Plain text -#: original/man8/ip6tables.8:342 original/man8/iptables.8:337 +#: original/man8/ip6tables.8:365 original/man8/iptables.8:353 #, fuzzy #| msgid "" #| "Verbose output. This option makes the list command show the interface " @@ -1197,14 +1291,14 @@ msgstr "" "delete, replace コマンドに適用すると、 ルールについての詳細な情報を表示する。" #. type: TP -#: original/man8/ip6tables.8:342 original/man8/iptables.8:337 +#: original/man8/ip6tables.8:365 original/man8/iptables.8:353 #, fuzzy, no-wrap #| msgid "B<-n, --numeric>" msgid "B<-n>, B<--numeric>" msgstr "B<-n, --numeric>" #. type: Plain text -#: original/man8/ip6tables.8:348 original/man8/iptables.8:343 +#: original/man8/ip6tables.8:371 original/man8/iptables.8:359 msgid "" "Numeric output. IP addresses and port numbers will be printed in numeric " "format. By default, the program will try to display them as host names, " @@ -1215,14 +1309,14 @@ msgstr "" "ホスト名・ネットワーク名・サービス名で表示しようとする。" #. type: TP -#: original/man8/ip6tables.8:348 original/man8/iptables.8:343 +#: original/man8/ip6tables.8:371 original/man8/iptables.8:359 #, fuzzy, no-wrap #| msgid "B<-x, --exact>" msgid "B<-x>, B<--exact>" msgstr "B<-x, --exact>" #. type: Plain text -#: original/man8/ip6tables.8:355 original/man8/iptables.8:350 +#: original/man8/ip6tables.8:378 original/man8/iptables.8:366 msgid "" "Expand numbers. Display the exact value of the packet and byte counters, " "instead of only the rounded number in K's (multiples of 1000) M's " @@ -1234,13 +1328,13 @@ msgstr "" "このオプションは、 B<-L> コマンドとしか関係しない。" #. type: TP -#: original/man8/ip6tables.8:355 original/man8/iptables.8:350 +#: original/man8/ip6tables.8:378 original/man8/iptables.8:366 #, no-wrap msgid "B<--line-numbers>" msgstr "B<--line-numbers>" #. type: Plain text -#: original/man8/ip6tables.8:359 original/man8/iptables.8:354 +#: original/man8/ip6tables.8:382 original/man8/iptables.8:370 msgid "" "When listing rules, add line numbers to the beginning of each rule, " "corresponding to that rule's position in the chain." @@ -1249,14 +1343,14 @@ msgstr "" "各行の始めに付加する。" #. type: TP -#: original/man8/ip6tables.8:359 original/man8/iptables.8:354 +#: original/man8/ip6tables.8:382 original/man8/iptables.8:370 #, fuzzy, no-wrap #| msgid "B<--modprobe=command>" msgid "B<--modprobe=>I" msgstr "B<--modprobe=command>" #. type: Plain text -#: original/man8/ip6tables.8:363 original/man8/iptables.8:358 +#: original/man8/ip6tables.8:386 original/man8/iptables.8:374 #, fuzzy #| msgid "" #| "When adding or inserting rules into a chain, use B to load any " @@ -1269,7566 +1363,8314 @@ msgstr "" "で) 必要なモジュールをロードするために使う B を指定する。" #. type: SH -#: original/man8/ip6tables.8:363 original/man8/iptables.8:358 +#: original/man8/ip6tables.8:386 original/man8/iptables-extensions.8:10 #, no-wrap msgid "MATCH EXTENSIONS" msgstr "マッチングの拡張" #. type: Plain text -#: original/man8/ip6tables.8:373 -#, fuzzy -#| msgid "" -#| "ip6tables can use extended packet matching modules. These are loaded in " -#| "two ways: implicitly, when B<-p> or B<--protocol> is specified, or with " -#| "the B<-m> or B<--match> options, followed by the matching module name; " -#| "after these, various extra command line options become available, " -#| "depending on the specific module. You can specify multiple extended " -#| "match modules in one line, and you can use the B<-h> or B<--help> options " -#| "after the module has been specified to receive help specific to that " -#| "module." -msgid "" -"ip6tables can use extended packet matching modules with the B<-m> or B<--" -"match> options, followed by the matching module name; after these, various " -"extra command line options become available, depending on the specific " -"module. You can specify multiple extended match modules in one line, and " -"you can use the B<-h> or B<--help> options after the module has been " -"specified to receive help specific to that module." -msgstr "" -"ip6tables は拡張されたパケットマッチングモジュールを使うことができる。 これら" -"のモジュールは 2 種類の方法でロードされる: モジュールは、 B<-p> または B<--" -"protocol> で暗黙のうちに指定されるか、 B<-m> または B<--match> の後にモジュー" -"ル名を続けて指定される。 これらのモジュールの後ろには、モジュールに応じて 他" -"のいろいろなコマンドラインオプションを指定することができる。 複数の拡張マッチ" -"ングモジュールを 1 行で指定することができる。 また、モジュールに特有のヘルプ" -"を表示させるためには、 モジュールを指定した後で B<-h> または B<--help> を指定" -"すればよい。" - -#. @MATCH@ -#. type: Plain text -#: original/man8/ip6tables.8:378 +#: original/man8/ip6tables.8:390 original/man8/iptables.8:378 msgid "" -"If the B<-p> or B<--protocol> was specified and if and only if an unknown " -"option is encountered, ip6tables will try load a match module of the same " -"name as the protocol, to try making the option available." +"iptables can use extended packet matching and target modules. A list of " +"these is available in the B(8) manpage." msgstr "" -#. type: SS -#: original/man8/ip6tables.8:378 original/man8/iptables.8:373 +#. type: SH +#: original/man8/ip6tables.8:390 original/man8/iptables.8:378 #, no-wrap -msgid "addrtype" -msgstr "" +msgid "DIAGNOSTICS" +msgstr "返り値" #. type: Plain text -#: original/man8/ip6tables.8:383 original/man8/iptables.8:378 +#: original/man8/ip6tables.8:395 original/man8/iptables.8:383 msgid "" -"This module matches packets based on their B
Address types " -"are used within the kernel networking stack and categorize addresses into " -"various groups. The exact definition of that group depends on the specific " -"layer three protocol." +"Various error messages are printed to standard error. The exit code is 0 " +"for correct functioning. Errors which appear to be caused by invalid or " +"abused command line parameters cause an exit code of 2, and other errors " +"cause an exit code of 1." msgstr "" +"いろいろなエラーメッセージが標準エラーに表示される。 正しく機能した場合、終了" +"コードは 0 である。 不正なコマンドラインパラメータによりエラーが発生した場合" +"は、 終了コード 2 が返される。 その他のエラーの場合は、終了コード 1 が返され" +"る。" #. type: Plain text -#: original/man8/ip6tables.8:385 original/man8/iptables.8:380 -#, fuzzy -#| msgid "The following additional options can be specified:" -msgid "The following address types are possible:" -msgstr "その他に以下のオプションを指定することができる:" +#: original/man8/ip6tables.8:398 +msgid "" +"Bugs? What's this? ;-) Well... the counters are not reliable on sparc64." +msgstr "" +"バグ? バグって何? ;-) えーと…、sparc64 ではカウンター値が信頼できない。" -#. type: TP -#: original/man8/ip6tables.8:385 original/man8/iptables.8:380 +#. type: SH +#: original/man8/ip6tables.8:398 original/man8/iptables.8:386 #, no-wrap -msgid "B" -msgstr "" +msgid "COMPATIBILITY WITH IPCHAINS" +msgstr "IPCHAINS との互換性" #. type: Plain text -#: original/man8/ip6tables.8:388 original/man8/iptables.8:383 -msgid "an unspecified address (i.e. 0.0.0.0)" -msgstr "" - -#. type: TP -#: original/man8/ip6tables.8:388 original/man8/iptables.8:383 -#, no-wrap -msgid "B" +#: original/man8/ip6tables.8:407 +msgid "" +"This B is very similar to ipchains by Rusty Russell. The main " +"difference is that the chains B and B are only traversed for " +"packets coming into the local host and originating from the local host " +"respectively. Hence every packet only passes through one of the three " +"chains (except loopback traffic, which involves both INPUT and OUTPUT " +"chains); previously a forwarded packet would pass through all three." msgstr "" +"B は、Rusty Russell の ipchains と非常によく似ている。 大きな違い" +"は、チェイン B と B が、それぞれローカルホストに入ってくるパ" +"ケットと、 ローカルホストから出されるパケットのみしか調べないという点であ" +"る。 よって、全てのパケットは 3 つあるチェインのうち 1 つしか通らない (ループ" +"バックトラフィックは例外で、INPUT と OUTPUT チェインの両方を通る)。 以前は " +"(ipchains では)、 フォワードされるパケットが 3 つのチェイン全てを通っていた。" #. type: Plain text -#: original/man8/ip6tables.8:391 original/man8/iptables.8:386 -msgid "an unicast address" +#: original/man8/ip6tables.8:412 +msgid "" +"The other main difference is that B<-i> refers to the input interface; B<-o> " +"refers to the output interface, and both are available for packets entering " +"the B chain. There are several other changes in ip6tables." msgstr "" +"その他の大きな違いは、 B<-i> で入力インターフェース、 B<-o> で出力インター" +"フェースを指定し、 ともに B チェインに入るパケットに対して指定可能な" +"点である。 ip6tables では、その他にもいくつかの変更がある。" -#. type: TP -#: original/man8/ip6tables.8:391 original/man8/iptables.8:386 -#, no-wrap -msgid "B" +#. type: Plain text +#: original/man8/ip6tables.8:421 +#, fuzzy +#| msgid "" +#| "B(8), B B(8), B(8), B(8)." +msgid "" +"B(8), B(8), B(8), B(8), B(8), B(8), B(8), B(3)." msgstr "" +"B(8), B B(8), B(8), B(8)." #. type: Plain text -#: original/man8/ip6tables.8:394 original/man8/iptables.8:389 -msgid "a local address" +#: original/man8/ip6tables.8:427 +#, fuzzy +#| msgid "" +#| "The packet-filtering-HOWTO details iptables usage for packet filtering, " +#| "the NAT-HOWTO details NAT, the netfilter-extensions-HOWTO details the " +#| "extensions that are not in the standard distribution, and the netfilter-" +#| "hacking-HOWTO details the netfilter internals." +msgid "" +"The packet-filtering-HOWTO details iptables usage for packet filtering, the " +"netfilter-extensions-HOWTO details the extensions that are not in the " +"standard distribution, and the netfilter-hacking-HOWTO details the netfilter " +"internals." msgstr "" +"パケットフィルタリングについての詳細な iptables の使用法を\n" +"説明している packet-filtering-HOWTO。\n" +"NAT について詳細に説明している NAT-HOWTO。\n" +"標準的な配布には含まれない拡張の詳細を 説明している \n" +"netfilter-extensions-HOWTO。\n" +"内部構造について詳細に説明している netfilter-hacking-HOWTO。" -#. type: TP -#: original/man8/ip6tables.8:394 original/man8/iptables.8:389 -#, no-wrap -msgid "B" -msgstr "" +#. type: Plain text +#: original/man8/ip6tables.8:430 original/man8/iptables.8:429 +msgid "See B." +msgstr "B を参照。" #. type: Plain text -#: original/man8/ip6tables.8:397 original/man8/iptables.8:392 -msgid "a broadcast address" +#: original/man8/ip6tables.8:433 +msgid "" +"Rusty Russell wrote iptables, in early consultation with Michael Neuling." msgstr "" +"Rusty Russell は、初期の段階で Michael Neuling に相談して iptables を書いた。" -#. type: TP -#: original/man8/ip6tables.8:397 original/man8/iptables.8:392 -#, no-wrap -msgid "B" +#. type: Plain text +#: original/man8/ip6tables.8:437 original/man8/iptables.8:436 +msgid "" +"Marc Boucher made Rusty abandon ipnatctl by lobbying for a generic packet " +"selection framework in iptables, then wrote the mangle table, the owner " +"match, the mark stuff, and ran around doing cool stuff everywhere." msgstr "" +"Marc Boucher は Rusty に iptables の一般的なパケット選択の考え方を勧めて、 " +"ipnatctl を止めさせた。 そして、mangle テーブル・所有者マッチング・ mark 機能" +"を書き、いたるところで使われている素晴らしいコードを書いた。" #. type: Plain text -#: original/man8/ip6tables.8:400 original/man8/iptables.8:395 -msgid "an anycast packet" -msgstr "" - -#. type: TP -#: original/man8/ip6tables.8:400 original/man8/iptables.8:395 -#, no-wrap -msgid "B" -msgstr "" +#: original/man8/ip6tables.8:439 original/man8/iptables.8:438 +msgid "James Morris wrote the TOS target, and tos match." +msgstr "James Morris が TOS ターゲットと tos マッチングを書いた。" #. type: Plain text -#: original/man8/ip6tables.8:403 original/man8/iptables.8:398 -msgid "a multicast address" -msgstr "" - -#. type: TP -#: original/man8/ip6tables.8:403 original/man8/iptables.8:398 -#, no-wrap -msgid "B" -msgstr "" +#: original/man8/ip6tables.8:441 original/man8/iptables.8:440 +msgid "Jozsef Kadlecsik wrote the REJECT target." +msgstr "Jozsef Kadlecsik が REJECT ターゲットを書いた。" #. type: Plain text -#: original/man8/ip6tables.8:406 original/man8/iptables.8:401 -msgid "a blackhole address" -msgstr "" - -#. type: TP -#: original/man8/ip6tables.8:406 original/man8/iptables.8:401 -#, no-wrap -msgid "B" +#: original/man8/ip6tables.8:443 +#, fuzzy +#| msgid "Harald Welte wrote the ULOG target, TTL match+target and libipulog." +msgid "" +"Harald Welte wrote the ULOG and NFQUEUE target, the new libiptc, as well as " +"TTL match+target and libipulog." msgstr "" +"Harald Welte が ULOG ターゲット・TTL マッチングと TTL ターゲット・ libipulog " +"を書いた。" #. type: Plain text -#: original/man8/ip6tables.8:409 original/man8/iptables.8:404 -msgid "an unreachable address" -msgstr "" - -#. type: TP -#: original/man8/ip6tables.8:409 original/man8/iptables.8:404 -#, no-wrap -msgid "B" +#: original/man8/ip6tables.8:447 original/man8/iptables.8:446 +#, fuzzy +#| msgid "" +#| "The Netfilter Core Team is: Marc Boucher, Martin Josefsson, Jozsef " +#| "Kadlecsik, James Morris, Harald Welte and Rusty Russell." +msgid "" +"The Netfilter Core Team is: Marc Boucher, Martin Josefsson, Yasuyuki " +"Kozakai, Jozsef Kadlecsik, Patrick McHardy, James Morris, Pablo Neira Ayuso, " +"Harald Welte and Rusty Russell." msgstr "" +"Netfilter コアチームは、Marc Boucher, Martin Josefsson, Jozsef Kadlecsik, " +"James Morris, Harald Welte, Rusty Russell である。" +#. .. and did I mention that we are incredibly cool people? +#. .. sexy, too .. +#. .. witty, charming, powerful .. +#. .. and most of all, modest .. #. type: Plain text -#: original/man8/ip6tables.8:412 original/man8/iptables.8:407 -msgid "a prohibited address" +#: original/man8/ip6tables.8:454 +msgid "" +"ip6tables man page created by Andras Kis-Szabo, based on iptables man page " +"written by Herve Eychenne Erv@wallfire.orgE." msgstr "" +"ip6tables の man ページは、Andras Kis-Szabo によって作成された。 これは " +"Herve Eychenne Erv@wallfire.orgE によって書かれた iptables の man " +"ページを元にしている。" -#. type: TP -#: original/man8/ip6tables.8:412 original/man8/iptables.8:407 +#. type: SH +#: original/man8/ip6tables.8:454 original/man8/iptables.8:452 #, no-wrap -msgid "B" +msgid "VERSION" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:415 original/man8/ip6tables.8:418 -#: original/man8/iptables.8:410 original/man8/iptables.8:413 -msgid "FIXME" +#: original/man8/ip6tables.8:456 +msgid "This manual page applies to ip6tables 1.4.18." msgstr "" -#. type: TP -#: original/man8/ip6tables.8:415 original/man8/iptables.8:410 +#. type: TH +#: original/man8/iptables-restore.8:1 #, no-wrap -msgid "B" -msgstr "" +msgid "IPTABLES-RESTORE" +msgstr "IPTABLES-RESTORE" -#. type: TP -#: original/man8/ip6tables.8:418 original/man8/iptables.8:413 +#. type: TH +#: original/man8/iptables-restore.8:1 original/man8/iptables-save.8:1 #, no-wrap -msgid "B" -msgstr "" - -#. type: TP -#: original/man8/ip6tables.8:420 original/man8/iptables.8:415 -#, fuzzy, no-wrap -#| msgid "B<--icmp-type >[!] I" -msgid "[B] B<--src-type> I" -msgstr "B<--icmp-type >[!] I" +msgid "Jan 04, 2001" +msgstr "Jan 04, 2001" #. type: Plain text -#: original/man8/ip6tables.8:423 original/man8/iptables.8:418 +#: original/man8/iptables-restore.8:23 #, fuzzy -#| msgid "" -#| "Matches if the packet was created by a process with the given process id." -msgid "Matches if the source address is of given type" -msgstr "" -"指定されたプロセス ID のプロセスにより パケットが生成されている場合にマッチす" -"る。" - -#. type: TP -#: original/man8/ip6tables.8:423 original/man8/iptables.8:418 -#, fuzzy, no-wrap -#| msgid "B<--icmp-type >[!] I" -msgid "[B] B<--dst-type> I" -msgstr "B<--icmp-type >[!] I" +#| msgid "iptables-restore - Restore IP Tables" +msgid "iptables-restore \\(em Restore IP Tables" +msgstr "iptables-restore - IP テーブルを復元する" #. type: Plain text -#: original/man8/ip6tables.8:426 original/man8/iptables.8:421 +#: original/man8/iptables-restore.8:26 #, fuzzy -#| msgid "Match against reply destination address" -msgid "Matches if the destination address is of given type" -msgstr "応答の宛先アドレスにマッチする。" - -#. type: TP -#: original/man8/ip6tables.8:426 original/man8/iptables.8:421 -#, fuzzy, no-wrap -#| msgid "B<--limit >I" -msgid "B<--limit-iface-in>" -msgstr "B<--limit >I" +#| msgid "B[-c] [-n]" +msgid "B [B<-chntv>] [B<-M> I] [B<-T> I]" +msgstr "B[-c] [-n]" #. type: Plain text -#: original/man8/ip6tables.8:437 original/man8/iptables.8:432 +#: original/man8/iptables-restore.8:31 msgid "" -"The address type checking can be limited to the interface the packet is " -"coming in. This option is only valid in the B, B and " -"B chains. It cannot be specified with the B<--limit-iface-out> " -"option." +"B is used to restore IP Tables from data specified on " +"STDIN. Use I/O redirection provided by your shell to read from a file" msgstr "" - -#. type: TP -#: original/man8/ip6tables.8:437 original/man8/iptables.8:432 -#, fuzzy, no-wrap -#| msgid "B<--limit >I" -msgid "B<--limit-iface-out>" -msgstr "B<--limit >I" +"B は標準入力で指定されたデータから IP テーブルを復元するた" +"めに使われる。 ファイルから読み込むためには、 シェルで提供されている I/O リダ" +"イレクションを使うこと。" #. type: Plain text -#: original/man8/ip6tables.8:448 original/man8/iptables.8:443 +#: original/man8/iptables-restore.8:42 +#, fuzzy +#| msgid "" +#| "don't flush the previous contents of the table. If not specified, " +#| "B flushes (deletes) all previous contents of the " +#| "respective IP Table." msgid "" -"The address type checking can be limited to the interface the packet is " -"going out. This option is only valid in the B, B and " -"B chains. It cannot be specified with the B<--limit-iface-in> " -"option." +"don't flush the previous contents of the table. If not specified, B flushes (deletes) all previous contents of the respective table." msgstr "" - -#. type: SS -#: original/man8/ip6tables.8:448 original/man8/iptables.8:443 -#, no-wrap -msgid "ah" -msgstr "ah" +"これまでのテーブルの内容をフラッシュしない。 指定されない場合、 B は、これまでの各 IP テーブルの内容を全てフラッシュ (削除) する。" #. type: Plain text -#: original/man8/ip6tables.8:450 -#, fuzzy -#| msgid "This module matches the SPIs in AH header of IPSec packets." +#: original/man8/iptables-restore.8:52 msgid "" -"This module matches the parameters in Authentication header of IPsec packets." -msgstr "このモジュールは IPSec パケットの AH ヘッダーの SPI 値にマッチする。" - -#. type: TP -#: original/man8/ip6tables.8:450 original/man8/iptables.8:445 -#, fuzzy, no-wrap -#| msgid "B<--ahspi >[!] I[:I]" -msgid "[B] B<--ahspi> I[B<:>I]" -msgstr "B<--ahspi >[!] I[:I]" +"Specify the path to the modprobe program. By default, iptables-restore will " +"inspect /proc/sys/kernel/modprobe to determine the executable's path." +msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:453 -msgid "Matches SPI." +#: original/man8/iptables-restore.8:55 +msgid "" +"Restore only the named table even if the input stream contains other ones." msgstr "" -#. type: TP -#: original/man8/ip6tables.8:453 -#, fuzzy, no-wrap -#| msgid "B<-t>, B<--table> B" -msgid "[B] B<--ahlen> I" -msgstr "B<-t>, B<--table> B" +#. type: SH +#: original/man8/iptables-restore.8:57 original/man8/iptables-save.8:44 +#: original/man1/iptables-xml.1:84 +#, no-wrap +msgid "AUTHOR" +msgstr "作者" #. type: Plain text -#: original/man8/ip6tables.8:456 original/man8/ip6tables.8:748 -#: original/man8/ip6tables.8:870 -msgid "Total length of this header in octets." -msgstr "" +#: original/man8/iptables-restore.8:61 +msgid "B(8), B(8)" +msgstr "B(8), B(8)" -#. type: TP -#: original/man8/ip6tables.8:456 +#. type: TH +#: original/man8/iptables-save.8:1 #, no-wrap -msgid "B<--ahres>" -msgstr "" +msgid "IPTABLES-SAVE" +msgstr "IPTABLES-SAVE" #. type: Plain text -#: original/man8/ip6tables.8:459 -msgid "Matches if the reserved field is filled with zero." +#: original/man8/iptables-save.8:23 +msgid "iptables-save \\(em dump iptables rules to stdout" msgstr "" -#. type: SS -#: original/man8/ip6tables.8:459 original/man8/iptables.8:447 -#, no-wrap -msgid "cluster" -msgstr "" +#. type: Plain text +#: original/man8/iptables-save.8:26 +#, fuzzy +#| msgid "B[-c] [-t table]" +msgid "B [B<-M> I] [B<-c>] [B<-t> I
]" +msgstr "B[-c] [-t table]" #. type: Plain text -#: original/man8/ip6tables.8:462 original/man8/iptables.8:450 +#: original/man8/iptables-save.8:31 msgid "" -"Allows you to deploy gateway and back-end load-sharing clusters without the " -"need of load-balancers." +"B is used to dump the contents of an IP Table in easily " +"parseable format to STDOUT. Use I/O-redirection provided by your shell to " +"write to a file." msgstr "" +"B は IP テーブルの内容を簡単に解析できる形式で 標準出力にダン" +"プするために使われる。 ファイルに書き出すためには、 シェルで提供されている I/" +"O リダイレクションを使うこと。" #. type: Plain text -#: original/man8/ip6tables.8:465 original/man8/iptables.8:453 -msgid "" -"This match requires that all the nodes see the same packets. Thus, the " -"cluster match decides if this node has to handle a packet given the " -"following options:" -msgstr "" +#: original/man8/iptables-save.8:48 +msgid "B(8), B(8)" +msgstr "B(8), B(8)" -#. type: TP -#: original/man8/ip6tables.8:465 original/man8/iptables.8:453 +#. type: TH +#: original/man8/iptables.8:1 #, no-wrap -msgid "B<--cluster-total-nodes> I" -msgstr "" +msgid "IPTABLES" +msgstr "IPTABLES" #. type: Plain text -#: original/man8/ip6tables.8:468 original/man8/iptables.8:456 -msgid "Set number of total nodes in cluster." -msgstr "" - -#. type: TP -#: original/man8/ip6tables.8:468 original/man8/iptables.8:456 -#, fuzzy, no-wrap -#| msgid "B<-t>, B<--table> B" -msgid "[B] B<--cluster-local-node> I" -msgstr "B<-t>, B<--table> B" +#: original/man8/iptables.8:27 +#, fuzzy +#| msgid "iptables - administration tool for IPv4 packet filtering and NAT" +msgid "iptables \\(em administration tool for IPv4 packet filtering and NAT" +msgstr "iptables - IPv4 のパケットフィルタと NAT を管理するツール" #. type: Plain text -#: original/man8/ip6tables.8:471 original/man8/iptables.8:459 -msgid "Set the local node number ID." -msgstr "" - -#. type: TP -#: original/man8/ip6tables.8:471 original/man8/iptables.8:459 -#, no-wrap -msgid "[B] B<--cluster-local-nodemask> I" -msgstr "" +#: original/man8/iptables.8:30 +#, fuzzy +#| msgid "Bchain rule-specification [options]" +msgid "" +"B [B<-t> I
] {B<-A>|B<-C>|B<-D>} I I" +msgstr "Bチェイン ルールの詳細 [オプション]" #. type: Plain text -#: original/man8/ip6tables.8:475 original/man8/iptables.8:463 +#: original/man8/iptables.8:32 +#, fuzzy +#| msgid "" +#| "Bchain [rulenum] rule-specification [options]" msgid "" -"Set the local node number ID mask. You can use this option instead of B<--" -"cluster-local-node>." +"B [B<-t> I
] B<-I> I [I] I" msgstr "" - -#. type: TP -#: original/man8/ip6tables.8:475 original/man8/iptables.8:463 -#, fuzzy, no-wrap -#| msgid "B<--set-mss >I" -msgid "B<--cluster-hash-seed> I" -msgstr "B<--set-mss >I" +"Bチェイン [ルール番号] ルールの詳細 [オプション]" #. type: Plain text -#: original/man8/ip6tables.8:478 original/man8/iptables.8:466 -msgid "Set seed value of the Jenkins hash." -msgstr "" +#: original/man8/iptables.8:34 +#, fuzzy +#| msgid "Bchain rulenum rule-specification [options]" +msgid "B [B<-t> I
] B<-R> I" +msgstr "" +"Bチェイン ルール番号 ルールの詳細 [オプション]" #. type: Plain text -#: original/man8/ip6tables.8:480 original/man8/ip6tables.8:526 -#: original/man8/ip6tables.8:563 original/man8/ip6tables.8:711 -#: original/man8/ip6tables.8:1837 original/man8/ip6tables.8:1885 -#: original/man8/ip6tables.8:1931 original/man8/iptables.8:468 -#: original/man8/iptables.8:514 original/man8/iptables.8:551 -#: original/man8/iptables.8:699 original/man8/iptables.8:1755 -#: original/man8/iptables.8:1803 original/man8/iptables.8:1852 -#, no-wrap -msgid "Example:" -msgstr "" +#: original/man8/iptables.8:36 +#, fuzzy +#| msgid "Bchain rulenum [options]" +msgid "B [B<-t> I
] B<-D> I" +msgstr "Bチェイン ルール番号 [オプション]" #. type: Plain text -#: original/man8/ip6tables.8:485 original/man8/iptables.8:473 -msgid "" -"iptables -A PREROUTING -t mangle -i eth1 -m cluster --cluster-total-nodes 2 " -"--cluster-local-node 1 --cluster-hash-seed 0xdeadbeef -j MARK --set-mark " -"0xffff" -msgstr "" +#: original/man8/iptables.8:38 +#, fuzzy +#| msgid "Bchain rulenum [options]" +msgid "B [B<-t> I
] B<-S> [I [I]]" +msgstr "Bチェイン ルール番号 [オプション]" #. type: Plain text -#: original/man8/ip6tables.8:490 original/man8/iptables.8:478 +#: original/man8/iptables.8:40 +#, fuzzy +#| msgid "Bchain rulenum [options]" msgid "" -"iptables -A PREROUTING -t mangle -i eth2 -m cluster --cluster-total-nodes 2 " -"--cluster-local-node 1 --cluster-hash-seed 0xdeadbeef -j MARK --set-mark " -"0xffff" -msgstr "" +"B [B<-t> I
] {B<-F>|B<-L>|B<-Z>} [I [I]] " +"[I]" +msgstr "Bチェイン ルール番号 [オプション]" #. type: Plain text -#: original/man8/ip6tables.8:493 original/man8/iptables.8:481 -msgid "" -"iptables -A PREROUTING -t mangle -i eth1 -m mark ! --mark 0xffff -j DROP" -msgstr "" +#: original/man8/iptables.8:42 +#, fuzzy +#| msgid "Bchain" +msgid "B [B<-t> I
] B<-N> I" +msgstr "Bチェイン" #. type: Plain text -#: original/man8/ip6tables.8:496 original/man8/iptables.8:484 -msgid "" -"iptables -A PREROUTING -t mangle -i eth2 -m mark ! --mark 0xffff -j DROP" -msgstr "" +#: original/man8/iptables.8:44 +#, fuzzy +#| msgid "B[chain]" +msgid "B [B<-t> I
] B<-X> [I]" +msgstr "B[チェイン]" #. type: Plain text -#: original/man8/ip6tables.8:498 original/man8/iptables.8:486 -msgid "And the following commands to make all nodes see the same packets:" -msgstr "" +#: original/man8/iptables.8:46 +#, fuzzy +#| msgid "Bchain target [options]" +msgid "B [B<-t> I
] B<-P> I" +msgstr "Bチェイン ターゲット [オプション]" #. type: Plain text -#: original/man8/ip6tables.8:500 original/man8/iptables.8:488 -msgid "ip maddr add 01:00:5e:00:01:01 dev eth1" -msgstr "" +#: original/man8/iptables.8:48 +#, fuzzy +#| msgid "Bold-chain-name new-chain-name" +msgid "B [B<-t> I
] B<-E> I" +msgstr "B旧チェイン名 新チェイン名" #. type: Plain text -#: original/man8/ip6tables.8:502 original/man8/iptables.8:490 -msgid "ip maddr add 01:00:5e:00:01:02 dev eth2" +#: original/man8/iptables.8:50 +msgid "rule-specification = [I] [I]" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:505 original/man8/iptables.8:493 -msgid "" -"arptables -A OUTPUT -o eth1 --h-length 6 -j mangle --mangle-mac-s " -"01:00:5e:00:01:01" +#: original/man8/iptables.8:52 +msgid "match = B<-m> I [I]" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:509 original/man8/iptables.8:497 -msgid "" -"arptables -A INPUT -i eth1 --h-length 6 --destination-mac 01:00:5e:00:01:01 -" -"j mangle --mangle-mac-d 00:zz:yy:xx:5a:27" +#: original/man8/iptables.8:54 +msgid "target = B<-j> I [I]" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:512 original/man8/iptables.8:500 +#: original/man8/iptables.8:60 +#, fuzzy +#| msgid "" +#| "B is used to set up, maintain, and inspect the tables of IP " +#| "packet filter rules in the Linux kernel. Several different tables may be " +#| "defined. Each table contains a number of built-in chains and may also " +#| "contain user-defined chains." msgid "" -"arptables -A OUTPUT -o eth2 --h-length 6 -j mangle --mangle-mac-s " -"01:00:5e:00:01:02" +"B is used to set up, maintain, and inspect the tables of IPv4 " +"packet filter rules in the Linux kernel. Several different tables may be " +"defined. Each table contains a number of built-in chains and may also " +"contain user-defined chains." msgstr "" +"B は Linux カーネルの IP パケットフィルタルールのテーブルを 設定・" +"管理・検査するために使われる。 複数の異なるテーブルを定義できる。 各テーブル" +"にはたくさんの組み込み済みチェインが含まれており、 さらにユーザー定義のチェイ" +"ンを加えることもできる。" #. type: Plain text -#: original/man8/ip6tables.8:516 original/man8/iptables.8:504 +#: original/man8/iptables.8:114 msgid "" -"arptables -A INPUT -i eth2 --h-length 6 --destination-mac 01:00:5e:00:01:02 -" -"j mangle --mangle-mac-d 00:zz:yy:xx:5a:27" +"This table is consulted when a packet that creates a new connection is " +"encountered. It consists of three built-ins: B (for altering " +"packets as soon as they come in), B (for altering locally-generated " +"packets before routing), and B (for altering packets as they " +"are about to go out)." msgstr "" +"このテーブルは新しい接続を開くようなパケットに対して参照される。 これには " +"B (パケットが入ってきた場合、すぐにそのパケットを変換するための" +"チェイン)・ B (ローカルで生成されたパケットをルーティングの前に変換す" +"るためのチェイン)・ B (パケットが出て行くときに変換するための" +"チェイン) という 3 つの組み込み済みチェインが含まれる。" #. type: Plain text -#: original/man8/ip6tables.8:520 original/man8/iptables.8:508 +#: original/man8/iptables.8:147 msgid "" -"In the case of TCP connections, pickup facility has to be disabled to avoid " -"marking TCP ACK packets coming in the reply direction as valid." -msgstr "" +"The options that are recognized by B can be divided into several " +"different groups." +msgstr "B で使えるオプションは、いくつかのグループに分けられる。" #. type: Plain text -#: original/man8/ip6tables.8:522 original/man8/iptables.8:510 -msgid "echo 0 E /proc/sys/net/netfilter/nf_conntrack_tcp_loose" -msgstr "" - -#. type: SS -#: original/man8/ip6tables.8:522 original/man8/iptables.8:510 -#, no-wrap -msgid "comment" +#: original/man8/iptables.8:153 +#, fuzzy +#| msgid "" +#| "These options specify the specific action to perform. Only one of them " +#| "can be specified on the command line unless otherwise specified below. " +#| "For all the long versions of the command and option names, you need to " +#| "use only enough letters to ensure that B can differentiate it " +#| "from all other options." +msgid "" +"These options specify the desired action to perform. Only one of them can be " +"specified on the command line unless otherwise stated below. For long " +"versions of the command and option names, you need to use only enough " +"letters to ensure that B can differentiate it from all other " +"options." msgstr "" +"これらのオプションは、実行する特定の動作を指定する。 以下の説明で注記されてい" +"ない限り、 コマンドラインで指定できるのはこの中の 1 つだけである。 長いバー" +"ジョンのコマンド名とオプション名は、 B が他のコマンド名やオプション" +"名と区別できる範囲で (文字を省略して) 指定することもできる。" #. type: Plain text -#: original/man8/ip6tables.8:524 original/man8/iptables.8:512 -msgid "Allows you to add comments (up to 256 characters) to any rule." +#: original/man8/iptables.8:188 +#, fuzzy +#| msgid "" +#| "List all rules in the selected chain. If no chain is selected, all " +#| "chains are listed. As every other iptables command, it applies to the " +#| "specified table (filter is the default), so NAT rules get listed by" +msgid "" +"List all rules in the selected chain. If no chain is selected, all chains " +"are listed. Like every other iptables command, it applies to the specified " +"table (filter is the default), so NAT rules get listed by" msgstr "" +"選択されたチェインにある全てのルールを一覧表示する。 チェインが指定されない場" +"合、全てのチェインにあるリストが一覧表示される。 他の各 iptables コマンドと同" +"様に、指定されたテーブル (デフォルトは filter) に対して作用する。 よって NAT " +"ルールを表示するには以下のようにする。" -#. type: TP -#: original/man8/ip6tables.8:524 original/man8/iptables.8:512 +#. type: Plain text +#: original/man8/iptables.8:190 #, no-wrap -msgid "B<--comment> I" -msgstr "" +msgid " iptables -t nat -n -L\n" +msgstr " iptables -t nat -n -L\n" #. type: Plain text -#: original/man8/ip6tables.8:529 original/man8/iptables.8:517 -msgid "iptables -A INPUT -i eth1 -m comment --comment \"my local LAN\"" -msgstr "" - -#. type: SS -#: original/man8/ip6tables.8:529 original/man8/iptables.8:517 +#: original/man8/iptables.8:199 #, no-wrap -msgid "connbytes" -msgstr "" +msgid " iptables -L -v\n" +msgstr " iptables -L -v\n" #. type: Plain text -#: original/man8/ip6tables.8:533 original/man8/iptables.8:521 +#: original/man8/iptables.8:205 +#, fuzzy +#| msgid "" +#| "List all rules in the selected chain. If no chain is selected, all " +#| "chains are listed. As every other iptables command, it applies to the " +#| "specified table (filter is the default), so NAT rules get listed by" msgid "" -"Match by how many bytes or packets a connection (or one of the two flows " -"constituting the connection) has transferred so far, or by average bytes per " -"packet." -msgstr "" - -#. type: Plain text -#: original/man8/ip6tables.8:535 original/man8/iptables.8:523 -msgid "The counters are 64-bit and are thus not expected to overflow ;)" +"Print all rules in the selected chain. If no chain is selected, all chains " +"are printed like iptables-save. Like every other iptables command, it " +"applies to the specified table (filter is the default)." msgstr "" +"選択されたチェインにある全てのルールを一覧表示する。 チェインが指定されない場" +"合、全てのチェインにあるリストが一覧表示される。 他の各 iptables コマンドと同" +"様に、指定されたテーブル (デフォルトは filter) に対して作用する。 よって NAT " +"ルールを表示するには以下のようにする。" #. type: Plain text -#: original/man8/ip6tables.8:538 original/man8/iptables.8:526 -msgid "" -"The primary use is to detect long-lived downloads and mark them to be " -"scheduled using a lower priority band in traffic control." +#: original/man8/iptables.8:248 +msgid "This option has no effect in iptables and iptables-restore." msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:541 original/man8/iptables.8:529 +#: original/man8/iptables.8:254 msgid "" -"The transferred bytes per connection can also be viewed through `conntrack -" -"L` and accessed via ctnetlink." +"If a rule using the B<-6> option is inserted with (and only with) iptables-" +"restore, it will be silently ignored. Any other uses will throw an error. " +"This option allows to put both IPv4 and IPv6 rules in a single rule file for " +"use with both iptables-restore and ip6tables-restore." msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:547 original/man8/iptables.8:535 +#: original/man8/iptables.8:265 +#, fuzzy +#| msgid "" +#| "The protocol of the rule or of the packet to check. The specified " +#| "protocol can be one of I, I, I, or I, or it can be a " +#| "numeric value, representing one of these protocols or a different one. A " +#| "protocol name from /etc/protocols is also allowed. A \"!\" argument " +#| "before the protocol inverts the test. The number zero is equivalent to " +#| "I. Protocol I will match with all protocols and is taken as " +#| "default when this option is omitted." msgid "" -"NOTE that for connections which have no accounting information, the match " -"will always return false. The \"net.netfilter.nf_conntrack_acct\" sysctl " -"flag controls whether B connections will be byte/packet counted. " -"Existing connection flows will not be gaining/losing a/the accounting " -"structure when be sysctl flag is flipped." +"The protocol of the rule or of the packet to check. The specified protocol " +"can be one of B, B, B, B, B, B, B or " +"the special keyword \"B\", or it can be a numeric value, representing " +"one of these protocols or a different one. A protocol name from /etc/" +"protocols is also allowed. A \"!\" argument before the protocol inverts the " +"test. The number zero is equivalent to B. \"B\" will match with " +"all protocols and is taken as default when this option is omitted." msgstr "" +"ルールで使われるプロトコル、またはチェックされるパケットのプロトコル。 指定で" +"きるプロトコルは、 I, I, I, I のいずれか 1 つか、数値で" +"ある。 数値には、これらのプロトコルのどれかないし別のプロトコルを表す 数値を" +"指定することができる。 /etc/protocols にあるプロトコル名も指定できる。 プロト" +"コルの前に \"!\" を置くと、そのプロトコルを除外するという意味になる。 数値 0 " +"は I と等しい。 プロトコル I は全てのプロトコルとマッチし、 このオ" +"プションが省略された際のデフォルトである。" #. type: TP -#: original/man8/ip6tables.8:547 original/man8/iptables.8:535 -#, no-wrap -msgid "[B] B<--connbytes> I[B<:>I]" -msgstr "" +#: original/man8/iptables.8:265 +#, fuzzy, no-wrap +#| msgid "B<-s, --source >[!] I
[/I]" +msgid "[B] B<-s>, B<--source> I
[BI][B<,>I<...>]" +msgstr "B<-s, --source >[!] I
[/I]" #. type: Plain text -#: original/man8/ip6tables.8:553 original/man8/iptables.8:541 +#: original/man8/iptables.8:282 +#, fuzzy +#| msgid "" +#| "Source specification. I
can be either a network name, a " +#| "hostname (please note that specifying any name to be resolved with a " +#| "remote query such as DNS is a really bad idea), a network IP address " +#| "(with /mask), or a plain IP address. The I can be either a network " +#| "mask or a plain number, specifying the number of 1's at the left side of " +#| "the network mask. Thus, a mask of I<24> is equivalent to " +#| "I<255.255.255.0>. A \"!\" argument before the address specification " +#| "inverts the sense of the address. The flag B<--src> is an alias for this " +#| "option." msgid "" -"match packets from a connection whose packets/bytes/average packet size is " -"more than FROM and less than TO bytes/packets. if TO is omitted only FROM " -"check is done. \"!\" is used to match packets not falling in the range." -msgstr "" - -#. type: TP -#: original/man8/ip6tables.8:553 original/man8/iptables.8:541 -#, no-wrap -msgid "B<--connbytes-dir> {B|B|B}" +"Source specification. I
can be either a network name, a hostname, a " +"network IP address (with BI), or a plain IP address. Hostnames will " +"be resolved once only, before the rule is submitted to the kernel. Please " +"note that specifying any name to be resolved with a remote query such as DNS " +"is a really bad idea. The I can be either a network mask or a plain " +"number, specifying the number of 1's at the left side of the network mask. " +"Thus, a mask of I<24> is equivalent to I<255.255.255.0>. A \"!\" argument " +"before the address specification inverts the sense of the address. The flag " +"B<--src> is an alias for this option. Multiple addresses can be specified, " +"but this will B (when adding with -A), or will " +"cause multiple rules to be deleted (with -D)." msgstr "" +"送信元の指定。 I
はホスト名 (DNS のようなリモートへの問い合わせで解" +"決する名前を指定するのは非常に良くない) ・ネットワーク IP アドレス (/mask を" +"指定する)・ 通常の IP アドレス、のいずれかである。 I はネットワークマス" +"クか、 ネットワークマスクの左側にある 1 の数を指定する数値である。 つまり、 " +"I<24> という mask は I<255.255.255.0> に等しい。 アドレス指定の前に \"!\" を" +"置くと、そのアドレスを除外するという意味になる。 フラグ B<--src> は、このオプ" +"ションの別名である。" -#. type: Plain text -#: original/man8/ip6tables.8:556 original/man8/iptables.8:544 -msgid "which packets to consider" -msgstr "" +#. type: TP +#: original/man8/iptables.8:282 +#, fuzzy, no-wrap +#| msgid "B<-d, --destination >[!] I
[/I]" +msgid "[B] B<-d>, B<--destination> I
[BI][B<,>I<...>]" +msgstr "B<-d, --destination >[!] I
[/I]" #. type: TP -#: original/man8/ip6tables.8:556 original/man8/iptables.8:544 -#, no-wrap -msgid "B<--connbytes-mode> {B|B|B}" -msgstr "" +#: original/man8/iptables.8:328 +#, fuzzy, no-wrap +#| msgid "B<[!] -f, --fragment>" +msgid "[B] B<-f>, B<--fragment>" +msgstr "B<[!] -f, --fragment>" #. type: Plain text -#: original/man8/ip6tables.8:563 original/man8/iptables.8:551 +#: original/man8/iptables.8:336 msgid "" -"whether to check the amount of packets, number of bytes transferred or the " -"average size (in bytes) of all packets received so far. Note that when \"both" -"\" is used together with \"avgpkt\", and data is going (mainly) only in one " -"direction (for example HTTP), the average packet size will be about half of " -"the actual data packets." +"This means that the rule only refers to second and further fragments of " +"fragmented packets. Since there is no way to tell the source or destination " +"ports of such a packet (or ICMP type), such a packet will not match any " +"rules which specify them. When the \"!\" argument precedes the \"-f\" flag, " +"the rule will only match head fragments, or unfragmented packets." msgstr "" +"このオプションは、分割されたパケット (fragmented packet) のうち 2 番目以降の" +"パケットだけを参照するルールであることを意味する。 このようなパケット (また" +"は ICMP タイプのパケット) は 送信元・送信先ポートを知る方法がないので、 送信" +"元や送信先を指定するようなルールにはマッチしない。 \"-f\" フラグの前に \"!\" " +"を置くと、 分割されたパケットのうち最初のものか、 分割されていないパケットだ" +"けにマッチする。" + +#. type: SH +#: original/man8/iptables.8:374 +#, fuzzy, no-wrap +#| msgid "TARGET EXTENSIONS" +msgid "MATCH AND TARGET EXTENSIONS" +msgstr "ターゲットの拡張" #. type: Plain text -#: original/man8/ip6tables.8:566 original/man8/iptables.8:554 +#: original/man8/iptables.8:386 msgid "" -"iptables .. -m connbytes --connbytes 10000:100000 --connbytes-dir both --" -"connbytes-mode bytes ..." +"Bugs? What's this? ;-) Well, you might want to have a look at http://" +"bugzilla.netfilter.org/" msgstr "" -#. type: SS -#: original/man8/ip6tables.8:566 original/man8/iptables.8:554 -#, fuzzy, no-wrap -#| msgid "limit" -msgid "connlimit" -msgstr "limit" - #. type: Plain text -#: original/man8/ip6tables.8:569 original/man8/iptables.8:557 +#: original/man8/iptables.8:395 msgid "" -"Allows you to restrict the number of parallel connections to a server per " -"client IP address (or client address block)." +"This B is very similar to ipchains by Rusty Russell. The main " +"difference is that the chains B and B are only traversed for " +"packets coming into the local host and originating from the local host " +"respectively. Hence every packet only passes through one of the three " +"chains (except loopback traffic, which involves both INPUT and OUTPUT " +"chains); previously a forwarded packet would pass through all three." msgstr "" - -#. type: TP -#: original/man8/ip6tables.8:569 original/man8/iptables.8:557 -#, fuzzy, no-wrap -#| msgid "B<--limit-burst >I" -msgid "B<--connlimit-upto> I" -msgstr "B<--limit-burst >I" +"B は、Rusty Russell の ipchains と非常によく似ている。 大きな違い" +"は、チェイン B と B が、それぞれローカルホストに入ってくるパ" +"ケットと、 ローカルホストから出されるパケットのみしか調べないという点であ" +"る。 よって、(INPUT と OUTPUT の両方のチェインを起動する ループバックトラ" +"フィックを除く) 全てのパケットは 3 つあるチェインのうち 1 しか通らない。 以" +"前は (ipchains では)、 フォワードされるパケットは 3 つのチェイン全てを通って" +"いた。" #. type: Plain text -#: original/man8/ip6tables.8:572 original/man8/iptables.8:560 -msgid "Match if the number of existing connections is below or equal I." +#: original/man8/iptables.8:399 +msgid "" +"The other main difference is that B<-i> refers to the input interface; B<-o> " +"refers to the output interface, and both are available for packets entering " +"the B chain." msgstr "" - -#. type: TP -#: original/man8/ip6tables.8:572 original/man8/iptables.8:560 -#, fuzzy, no-wrap -#| msgid "B<--limit-burst >I" -msgid "B<--connlimit-above> I" -msgstr "B<--limit-burst >I" +"その他の大きな違いは、 B<-i> で入力インターフェース、 B<-o> で出力インター" +"フェースを参照すること、 そしてともに B チェインに入るパケットに対し" +"て指定可能な点である。" #. type: Plain text -#: original/man8/ip6tables.8:575 original/man8/iptables.8:563 -msgid "Match if the number of existing connections is above I." +#: original/man8/iptables.8:405 +msgid "" +"The various forms of NAT have been separated out; B is a pure " +"packet filter when using the default `filter' table, with optional extension " +"modules. This should simplify much of the previous confusion over the " +"combination of IP masquerading and packet filtering seen previously. So the " +"following options are handled differently:" msgstr "" +"NAT のいろいろな形式が分割された。 オプションの拡張モジュールとともに デフォ" +"ルトの「フィルタ」テーブルを用いた場合、 B は純粋なパケットフィルタ" +"となる。 これは、以前みられた IP マスカレーディングとパケットフィルタリング" +"の 組合せによる混乱を簡略化する。 よって、オプション" -#. type: TP -#: original/man8/ip6tables.8:575 original/man8/iptables.8:563 +#. type: Plain text +#: original/man8/iptables.8:409 #, no-wrap -msgid "B<--connlimit-mask> I" +msgid "" +" -j MASQ\n" +" -M -S\n" +" -M -L\n" msgstr "" +" -j MASQ\n" +" -M -S\n" +" -M -L\n" #. type: Plain text -#: original/man8/ip6tables.8:580 original/man8/iptables.8:568 -msgid "" -"Group hosts using the prefix length. For IPv4, this must be a number between " -"(including) 0 and 32. For IPv6, between 0 and 128. If not specified, the " -"maximum prefix length for the applicable protocol is used." +#: original/man8/iptables.8:411 +msgid "There are several other changes in iptables." msgstr "" +"は別のものとして扱われる。 iptables では、その他にもいくつかの変更がある。" -#. type: TP -#: original/man8/ip6tables.8:580 original/man8/iptables.8:568 -#, no-wrap -msgid "B<--connlimit-saddr>" +#. type: Plain text +#: original/man8/iptables.8:420 +#, fuzzy +#| msgid "" +#| "B(8), B(8), B(8), B(8), B(8)." +msgid "" +"B(8), B(8), B(8), " +"B(8), B(8), B(8), " +"B(8), B(3)." msgstr "" +"B(8), B(8), B(8), B(8), B(8)." #. type: Plain text -#: original/man8/ip6tables.8:584 original/man8/iptables.8:572 +#: original/man8/iptables.8:426 msgid "" -"Apply the limit onto the source group. This is the default if --connlimit-" -"daddr is not specified." +"The packet-filtering-HOWTO details iptables usage for packet filtering, the " +"NAT-HOWTO details NAT, the netfilter-extensions-HOWTO details the extensions " +"that are not in the standard distribution, and the netfilter-hacking-HOWTO " +"details the netfilter internals." msgstr "" +"パケットフィルタリングについての詳細な iptables の使用法を\n" +"説明している packet-filtering-HOWTO。\n" +"NAT について詳細に説明している NAT-HOWTO。\n" +"標準的な配布には含まれない拡張の詳細を 説明している \n" +"netfilter-extensions-HOWTO。\n" +"内部構造について詳細に説明している netfilter-hacking-HOWTO。" -#. type: TP -#: original/man8/ip6tables.8:584 original/man8/iptables.8:572 -#, no-wrap -msgid "B<--connlimit-daddr>" +#. type: Plain text +#: original/man8/iptables.8:432 +#, fuzzy +#| msgid "" +#| "Rusty Russell wrote iptables, in early consultation with Michael Neuling." +msgid "" +"Rusty Russell originally wrote iptables, in early consultation with Michael " +"Neuling." msgstr "" +"Rusty Russell は、初期の段階で Michael Neuling に相談して iptables を書いた。" #. type: Plain text -#: original/man8/ip6tables.8:587 original/man8/iptables.8:575 -msgid "Apply the limit onto the destination group." +#: original/man8/iptables.8:442 +#, fuzzy +#| msgid "" +#| "Harald Welte wrote the ULOG target, TTL, DSCP, ECN matches and targets." +msgid "" +"Harald Welte wrote the ULOG and NFQUEUE target, the new libiptc, as well as " +"the TTL, DSCP, ECN matches and targets." msgstr "" +"Harald Welte が ULOG ターゲットと、 TTL, DSCP, ECN のマッチ・ターゲットを書い" +"た。" +#. .. and did I mention that we are incredibly cool people? +#. .. sexy, too .. +#. .. witty, charming, powerful .. +#. .. and most of all, modest .. #. type: Plain text -#: original/man8/ip6tables.8:589 original/man8/ip6tables.8:852 -#: original/man8/ip6tables.8:1390 original/man8/ip6tables.8:1514 -#: original/man8/iptables.8:577 original/man8/iptables.8:800 -#: original/man8/iptables.8:1317 original/man8/iptables.8:1421 -msgid "Examples:" -msgstr "" +#: original/man8/iptables.8:452 +#, fuzzy +#| msgid "Man page written by Herve Eychenne Erv@wallfire.orgE." +msgid "" +"Man page originally written by Herve Eychenne Erv@wallfire.orgE." +msgstr "man ページは Herve Eychenne Erv@wallfire.orgE が書いた。" -#. type: TP -#: original/man8/ip6tables.8:589 original/man8/iptables.8:577 -#, no-wrap -msgid "# allow 2 telnet connections per client host" +#. type: Plain text +#: original/man8/iptables.8:454 +msgid "This manual page applies to iptables 1.4.18." msgstr "" +#. type: TH +#: original/man8/iptables-extensions.8:1 +#, fuzzy, no-wrap +#| msgid " iptables -m tos -h\n" +msgid "iptables-extensions" +msgstr " iptables -m tos -h\n" + #. type: Plain text -#: original/man8/ip6tables.8:592 original/man8/iptables.8:580 +#: original/man8/iptables-extensions.8:4 +#, fuzzy +#| msgid "" +#| "iptables can use extended target modules: the following are included in " +#| "the standard distribution." msgid "" -"iptables -A INPUT -p tcp --syn --dport 23 -m connlimit --connlimit-above 2 -" -"j REJECT" +"iptables-extensions \\(em list of extensions in the standard iptables " +"distribution" msgstr "" +"iptables は拡張ターゲットモジュールを使うことができる: 以下のものが、標準的な" +"ディストリビューションに含まれている。" -#. type: TP -#: original/man8/ip6tables.8:592 original/man8/iptables.8:580 -#, no-wrap -msgid "# you can also match the other way around:" +#. type: Plain text +#: original/man8/iptables-extensions.8:7 +#, fuzzy +#| msgid "Bchain target [options]" +msgid "" +"B [B<-m> I [I...]] [B<-j> I " +"[I...]" +msgstr "Bチェイン ターゲット [オプション]" + +#. type: Plain text +#: original/man8/iptables-extensions.8:10 +#, fuzzy +#| msgid "Bchain target [options]" +msgid "" +"B [B<-m> I [I...]] [B<-j> I " +"[I...]" +msgstr "Bチェイン ターゲット [オプション]" + +#. type: Plain text +#: original/man8/iptables-extensions.8:20 +#, fuzzy +#| msgid "" +#| "iptables can use extended packet matching modules. These are loaded in " +#| "two ways: implicitly, when B<-p> or B<--protocol> is specified, or with " +#| "the B<-m> or B<--match> options, followed by the matching module name; " +#| "after these, various extra command line options become available, " +#| "depending on the specific module. You can specify multiple extended " +#| "match modules in one line, and you can use the B<-h> or B<--help> options " +#| "after the module has been specified to receive help specific to that " +#| "module." +msgid "" +"iptables can use extended packet matching modules with the B<-m> or B<--" +"match> options, followed by the matching module name; after these, various " +"extra command line options become available, depending on the specific " +"module. You can specify multiple extended match modules in one line, and " +"you can use the B<-h> or B<--help> options after the module has been " +"specified to receive help specific to that module. The extended match " +"modules are evaluated in the order they are specified in the rule." msgstr "" +"iptables は拡張されたパケットマッチングモジュールを使うことができる。 これら" +"のモジュールは 2 種類の方法でロードされる: モジュールは、 B<-p> または B<--" +"protocol> で暗黙のうちに指定されるか、 B<-m> または B<--match> の後にモジュー" +"ル名を続けて指定される。 これらのモジュールの後ろには、モジュールに応じて 他" +"のいろいろなコマンドラインオプションを指定することができる。 複数の拡張マッチ" +"ングモジュールを一行で指定することができる。 また、モジュールに特有のヘルプを" +"表示させるためには、 モジュールを指定した後で B<-h> または B<--help> を指定す" +"ればよい。" +#. @MATCH@ #. type: Plain text -#: original/man8/ip6tables.8:595 original/man8/iptables.8:583 +#: original/man8/iptables-extensions.8:25 msgid "" -"iptables -A INPUT -p tcp --syn --dport 23 -m connlimit --connlimit-upto 2 -j " -"ACCEPT" +"If the B<-p> or B<--protocol> was specified and if and only if an unknown " +"option is encountered, iptables will try load a match module of the same " +"name as the protocol, to try making the option available." msgstr "" -#. type: TP -#: original/man8/ip6tables.8:595 original/man8/iptables.8:583 +#. type: SS +#: original/man8/iptables-extensions.8:25 #, no-wrap -msgid "# limit the number of parallel HTTP requests to 16 per class C sized source network (24 bit netmask)" +msgid "addrtype" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:600 original/man8/iptables.8:588 +#: original/man8/iptables-extensions.8:30 msgid "" -"iptables -p tcp --syn --dport 80 -m connlimit --connlimit-above 16 --" -"connlimit-mask 24 -j REJECT" +"This module matches packets based on their B
Address types " +"are used within the kernel networking stack and categorize addresses into " +"various groups. The exact definition of that group depends on the specific " +"layer three protocol." msgstr "" +#. type: Plain text +#: original/man8/iptables-extensions.8:32 +#, fuzzy +#| msgid "The following additional options can be specified:" +msgid "The following address types are possible:" +msgstr "その他に以下のオプションを指定することができる:" + #. type: TP -#: original/man8/ip6tables.8:600 original/man8/iptables.8:588 +#: original/man8/iptables-extensions.8:32 #, no-wrap -msgid "# limit the number of parallel HTTP requests to 16 for the link local network" +msgid "B" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:605 original/man8/iptables.8:593 -msgid "" -"(ipv6) ip6tables -p tcp --syn --dport 80 -s fe80::/64 -m connlimit --" -"connlimit-above 16 --connlimit-mask 64 -j REJECT" +#: original/man8/iptables-extensions.8:35 +msgid "an unspecified address (i.e. 0.0.0.0)" msgstr "" #. type: TP -#: original/man8/ip6tables.8:605 original/man8/iptables.8:593 +#: original/man8/iptables-extensions.8:35 #, no-wrap -msgid "# Limit the number of connections to a particular host:" +msgid "B" msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:609 original/man8/iptables.8:597 -msgid "" -"ip6tables -p tcp --syn --dport 49152:65535 -d 2001:db8::1 -m connlimit --" -"connlimit-above 100 -j REJECT" +#: original/man8/iptables-extensions.8:38 +msgid "an unicast address" msgstr "" -#. type: SS -#: original/man8/ip6tables.8:609 original/man8/iptables.8:597 -#, fuzzy, no-wrap -#| msgid "conntrack" -msgid "connmark" -msgstr "conntrack" +#. type: TP +#: original/man8/iptables-extensions.8:38 +#, no-wrap +msgid "B" +msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:612 original/man8/iptables.8:600 -#, fuzzy -#| msgid "" -#| "This module matches the netfilter mark field associated with a packet " -#| "(which can be set using the B target below)." -msgid "" -"This module matches the netfilter mark field associated with a connection " -"(which can be set using the B target below)." +#: original/man8/iptables-extensions.8:41 +msgid "a local address" msgstr "" -"このモジュールはパケットに関連づけられた netfilter の mark フィールドにマッチ" -"する (このフィールドは、以下の B ターゲットで設定される)。" #. type: TP -#: original/man8/ip6tables.8:612 original/man8/ip6tables.8:1023 -#: original/man8/iptables.8:600 original/man8/iptables.8:909 -#, fuzzy, no-wrap -#| msgid "B<--mark >I[/I]" -msgid "[B] B<--mark> I[BI]" -msgstr "B<--mark >I[/I]" +#: original/man8/iptables-extensions.8:41 +#, no-wrap +msgid "B" +msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:616 original/man8/iptables.8:604 -#, fuzzy -#| msgid "" -#| "Matches packets with the given unsigned mark value (if a mask is " -#| "specified, this is logically ANDed with the mask before the comparison)." -msgid "" -"Matches packets in connections with the given mark value (if a mask is " -"specified, this is logically ANDed with the mark before the comparison)." +#: original/man8/iptables-extensions.8:44 +msgid "a broadcast address" msgstr "" -"指定された符号なし mark 値のパケットにマッチする (mask が指定されると、比較の" -"前に mask との論理積 (AND) がとられる)。" -#. type: SS -#: original/man8/ip6tables.8:616 original/man8/iptables.8:604 +#. type: TP +#: original/man8/iptables-extensions.8:44 #, no-wrap -msgid "conntrack" -msgstr "conntrack" +msgid "B" +msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:619 original/man8/iptables.8:607 -#, fuzzy -#| msgid "" -#| "This module, when combined with connection tracking, allows access to the " -#| "connection tracking state for this packet." -msgid "" -"This module, when combined with connection tracking, allows access to the " -"connection tracking state for this packet/connection." +#: original/man8/iptables-extensions.8:47 +msgid "an anycast packet" msgstr "" -"このモジュールは、接続追跡 (connection tracking) と組み合わせて用いると、 パ" -"ケットについての接続追跡状態を知ることができる。" #. type: TP -#: original/man8/ip6tables.8:619 original/man8/iptables.8:607 -#, fuzzy, no-wrap -#| msgid "B<--ctstate >I" -msgid "[B] B<--ctstate> I" -msgstr "B<--ctstate >I" +#: original/man8/iptables-extensions.8:47 +#, no-wrap +msgid "B" +msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:623 original/man8/iptables.8:611 -msgid "" -"I is a comma separated list of the connection states to match. " -"Possible states are listed below." +#: original/man8/iptables-extensions.8:50 +msgid "a multicast address" msgstr "" #. type: TP -#: original/man8/ip6tables.8:623 original/man8/iptables.8:611 -#, fuzzy, no-wrap -#| msgid "B<--ctproto >I" -msgid "[B] B<--ctproto> I" -msgstr "B<--ctproto >I" +#: original/man8/iptables-extensions.8:50 +#, no-wrap +msgid "B" +msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:626 original/man8/iptables.8:614 -#, fuzzy -#| msgid "Protocol to match (by number or name)" -msgid "Layer-4 protocol to match (by number or name)" -msgstr "(名前または数値で) 指定されたプロトコルにマッチする。" +#: original/man8/iptables-extensions.8:53 +msgid "a blackhole address" +msgstr "" #. type: TP -#: original/man8/ip6tables.8:626 original/man8/iptables.8:614 -#, fuzzy, no-wrap -#| msgid "B<--ctorigsrc >I<[!] address[/mask]>" -msgid "[B] B<--ctorigsrc> I
[BI]" -msgstr "B<--ctorigsrc >I<[!] address[/mask]>" +#: original/man8/iptables-extensions.8:53 +#, no-wrap +msgid "B" +msgstr "" -#. type: TP -#: original/man8/ip6tables.8:628 original/man8/iptables.8:616 -#, fuzzy, no-wrap -#| msgid "B<--ctorigdst >I<[!] address[/mask]>" -msgid "[B] B<--ctorigdst> I
[BI]" -msgstr "B<--ctorigdst >I<[!] address[/mask]>" +#. type: Plain text +#: original/man8/iptables-extensions.8:56 +msgid "an unreachable address" +msgstr "" #. type: TP -#: original/man8/ip6tables.8:630 original/man8/iptables.8:618 -#, fuzzy, no-wrap -#| msgid "B<--ctrepldst >I<[!] address>B<[/>IB<]>" -msgid "[B] B<--ctreplsrc> I
[BI]" -msgstr "B<--ctrepldst >I<[!] address>B<[/>IB<]>" +#: original/man8/iptables-extensions.8:56 +#, no-wrap +msgid "B" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:59 +msgid "a prohibited address" +msgstr "" #. type: TP -#: original/man8/ip6tables.8:632 original/man8/iptables.8:620 -#, fuzzy, no-wrap -#| msgid "B<--ctrepldst >I<[!] address>B<[/>IB<]>" -msgid "[B] B<--ctrepldst> I
[BI]" -msgstr "B<--ctrepldst >I<[!] address>B<[/>IB<]>" +#: original/man8/iptables-extensions.8:59 +#, no-wrap +msgid "B" +msgstr "" #. type: Plain text -#: original/man8/ip6tables.8:635 original/man8/iptables.8:623 -#, fuzzy -#| msgid "Match against original destination address" -msgid "Match against original/reply source/destination address" -msgstr "書き換え前の宛先アドレスにマッチする。" +#: original/man8/iptables-extensions.8:62 +#: original/man8/iptables-extensions.8:65 +msgid "FIXME" +msgstr "" #. type: TP -#: original/man8/ip6tables.8:635 original/man8/iptables.8:623 -#, fuzzy, no-wrap -#| msgid "B<--source-port >[!] I[:I]" -msgid "[B] B<--ctorigsrcport> I[B<:>I]" -msgstr "B<--source-port >[!] I[:I]" +#: original/man8/iptables-extensions.8:62 +#, no-wrap +msgid "B" +msgstr "" #. type: TP -#: original/man8/ip6tables.8:637 original/man8/iptables.8:625 -#, fuzzy, no-wrap -#| msgid "B<--to-ports >I[-I]" -msgid "[B] B<--ctorigdstport> I[B<:>I]" -msgstr "B<--to-ports >I[-I]" +#: original/man8/iptables-extensions.8:65 +#, no-wrap +msgid "B" +msgstr "" #. type: TP -#: original/man8/ip6tables.8:639 original/man8/iptables.8:627 +#: original/man8/iptables-extensions.8:67 #, fuzzy, no-wrap -#| msgid "B<--source-port >[!] I[:I]" -msgid "[B] B<--ctreplsrcport> I[B<:>I]" -msgstr "B<--source-port >[!] I[:I]" +#| msgid "B<--icmp-type >[!] I" +msgid "[B] B<--src-type> I" +msgstr "B<--icmp-type >[!] I" + +#. type: Plain text +#: original/man8/iptables-extensions.8:70 +#, fuzzy +#| msgid "" +#| "Matches if the packet was created by a process with the given process id." +msgid "Matches if the source address is of given type" +msgstr "" +"指定されたプロセス ID のプロセスにより パケットが生成されている場合にマッチす" +"る。" #. type: TP -#: original/man8/ip6tables.8:641 original/man8/iptables.8:629 +#: original/man8/iptables-extensions.8:70 #, fuzzy, no-wrap -#| msgid "B<--source-port >[!] I[:I]" -msgid "[B] B<--ctrepldstport> I[B<:>I]" -msgstr "B<--source-port >[!] I[:I]" +#| msgid "B<--icmp-type >[!] I" +msgid "[B] B<--dst-type> I" +msgstr "B<--icmp-type >[!] I" #. type: Plain text -#: original/man8/ip6tables.8:645 original/man8/iptables.8:633 -msgid "" -"Match against original/reply source/destination port (TCP/UDP/etc.) or GRE " -"key. Matching against port ranges is only supported in kernel versions " -"above 2.6.38." -msgstr "" +#: original/man8/iptables-extensions.8:73 +#, fuzzy +#| msgid "Match against reply destination address" +msgid "Matches if the destination address is of given type" +msgstr "応答の宛先アドレスにマッチする。" #. type: TP -#: original/man8/ip6tables.8:645 original/man8/iptables.8:633 +#: original/man8/iptables-extensions.8:73 #, fuzzy, no-wrap -#| msgid "B<--ctstate >I" -msgid "[B] B<--ctstatus> I" -msgstr "B<--ctstate >I" +#| msgid "B<--limit >I" +msgid "B<--limit-iface-in>" +msgstr "B<--limit >I" #. type: Plain text -#: original/man8/ip6tables.8:649 original/man8/iptables.8:637 +#: original/man8/iptables-extensions.8:84 msgid "" -"I is a comma separated list of the connection statuses to " -"match. Possible statuses are listed below." +"The address type checking can be limited to the interface the packet is " +"coming in. This option is only valid in the B, B and " +"B chains. It cannot be specified with the B<--limit-iface-out> " +"option." msgstr "" #. type: TP -#: original/man8/ip6tables.8:649 original/man8/iptables.8:637 +#: original/man8/iptables-extensions.8:84 #, fuzzy, no-wrap -#| msgid "B<--ctexpire >I" -msgid "[B] B<--ctexpire> I
]" -msgstr "B[-c] [-t table]" +#. type: TP +#: original/man8/iptables-extensions.8:1826 +#, fuzzy, no-wrap +#| msgid "B<--uid-owner >I" +msgid "B<--zone> I" +msgstr "B<--uid-owner >I" #. type: Plain text -#: original/man8/iptables-save.8:31 +#: original/man8/iptables-extensions.8:1830 msgid "" -"B is used to dump the contents of an IP Table in easily " -"parseable format to STDOUT. Use I/O-redirection provided by your shell to " -"write to a file." +"Assign this packet to zone I and only have lookups done in that zone. " +"By default, packets have zone 0." msgstr "" -"B は IP テーブルの内容を簡単に解析できる形式で 標準出力にダン" -"プするために使われる。 ファイルに書き出すためには、 シェルで提供されている I/" -"O リダイレクションを使うこと。" + +#. type: TP +#: original/man8/iptables-extensions.8:1830 +#, fuzzy, no-wrap +#| msgid "B<--set-mss >I" +msgid "B<--timeout> I" +msgstr "B<--set-mss >I" #. type: Plain text -#: original/man8/iptables-save.8:48 -msgid "B(8), B(8)" -msgstr "B(8), B(8)" +#: original/man8/iptables-extensions.8:1835 +msgid "" +"Use the timeout policy identified by I for the connection. This is " +"provides more flexible timeout policy definition than global timeout values " +"available at /proc/sys/net/netfilter/nf_conntrack_*_timeout_*." +msgstr "" -#. type: TH -#: original/man8/iptables.8:1 +#. type: SS +#: original/man8/iptables-extensions.8:1835 #, no-wrap -msgid "IPTABLES" -msgstr "IPTABLES" +msgid "DNAT (IPv4-specific)" +msgstr "" #. type: Plain text -#: original/man8/iptables.8:27 -#, fuzzy -#| msgid "iptables - administration tool for IPv4 packet filtering and NAT" -msgid "iptables \\(em administration tool for IPv4 packet filtering and NAT" -msgstr "iptables - IPv4 のパケットフィルタと NAT を管理するツール" +#: original/man8/iptables-extensions.8:1847 +msgid "" +"This target is only valid in the B table, in the B and " +"B chains, and user-defined chains which are only called from those " +"chains. It specifies that the destination address of the packet should be " +"modified (and all future packets in this connection will also be mangled), " +"and rules should cease being examined. It takes one type of option:" +msgstr "" +"このターゲットは B テーブルの B, B チェイン、これら" +"のチェインから呼び出される ユーザー定義チェインのみで有効である。 このター" +"ゲットはパケットの送信先アドレスを修正する (この接続の以降のパケットも修正し" +"て分からなく (mangle) する)。 さらに、ルールによるチェックを止めさせる。 この" +"ターゲットにはオプションが 1 種類ある:" + +#. type: TP +#: original/man8/iptables-extensions.8:1847 +#, fuzzy, no-wrap +#| msgid "B<--to-destination >I[-I][:I-I]" +msgid "B<--to-destination> [I[B<->I]][B<:>I[B<->I]]" +msgstr "B<--to-destination >I[-I][:I-I]" #. type: Plain text -#: original/man8/iptables.8:30 +#: original/man8/iptables-extensions.8:1858 #, fuzzy -#| msgid "Bchain rule-specification [options]" +#| msgid "" +#| "which can specify a single new destination IP address, an inclusive range " +#| "of IP addresses, and optionally, a port range (which is only valid if the " +#| "rule also specifies B<-p tcp> or B<-p udp>). If no port range is " +#| "specified, then the destination port will never be modified." msgid "" -"B [B<-t> I
] {B<-A>|B<-C>|B<-D>} I I" -msgstr "Bチェイン ルールの詳細 [オプション]" +"which can specify a single new destination IP address, an inclusive range of " +"IP addresses, and optionally, a port range (which is only valid if the rule " +"also specifies B<-p tcp> or B<-p udp>). If no port range is specified, then " +"the destination port will never be modified. If no IP address is specified " +"then only the destination port will be modified." +msgstr "" +"1 つの新しい送信先 IP アドレス、または IP アドレスの範囲が指定できる。 ポート" +"の範囲を指定することもできる (これはルールで B<-p tcp> または B<-p udp> を指" +"定している場合にのみ有効)。 ポートの範囲が指定されていない場合、送信先ポート" +"は変更されない。" #. type: Plain text -#: original/man8/iptables.8:32 +#: original/man8/iptables-extensions.8:1865 #, fuzzy #| msgid "" -#| "Bchain [rulenum] rule-specification [options]" +#| "You can add several --to-destination options. If you specify more than " +#| "one destination address, either via an address range or multiple --to-" +#| "destination options, a simple round-robin (one after another in cycle) " +#| "load balancing takes place between these adresses." msgid "" -"B [B<-t> I
] B<-I> I [I] I" +"In Kernels up to 2.6.10 you can add several --to-destination options. For " +"those kernels, if you specify more than one destination address, either via " +"an address range or multiple --to-destination options, a simple round-robin " +"(one after another in cycle) load balancing takes place between these " +"addresses. Later Kernels (E= 2.6.11-rc1) don't have the ability to NAT " +"to multiple ranges anymore." msgstr "" -"Bチェイン [ルール番号] ルールの詳細 [オプション]" +"複数の --to-destination オプションを指定することができる。 アドレスの範囲に" +"よって、 もしくは複数の --to-destination オプションによって 2 つ以上の送信先" +"アドレスを指定した場合、 それらのアドレスを使った単純なラウンド・ロビン (順々" +"に循環させる) がおこなわれる。" -#. type: Plain text -#: original/man8/iptables.8:34 -#, fuzzy -#| msgid "Bchain rulenum rule-specification [options]" -msgid "B [B<-t> I
] B<-R> I" +#. type: TP +#: original/man8/iptables-extensions.8:1865 +#: original/man8/iptables-extensions.8:2145 +#: original/man8/iptables-extensions.8:2176 +#: original/man8/iptables-extensions.8:2299 +#: original/man8/iptables-extensions.8:2387 +#: original/man8/iptables-extensions.8:2456 +#, no-wrap +msgid "B<--random>" msgstr "" -"Bチェイン ルール番号 ルールの詳細 [オプション]" #. type: Plain text -#: original/man8/iptables.8:36 -#, fuzzy -#| msgid "Bchain rulenum [options]" -msgid "B [B<-t> I
] B<-D> I" -msgstr "Bチェイン ルール番号 [オプション]" +#: original/man8/iptables-extensions.8:1870 +#: original/man8/iptables-extensions.8:2304 +msgid "" +"If option B<--random> is used then port mapping will be randomized (kernel " +"E= 2.6.22)." +msgstr "" -#. type: Plain text -#: original/man8/iptables.8:38 -#, fuzzy -#| msgid "Bchain rulenum [options]" -msgid "B [B<-t> I
] B<-S> [I [I]]" -msgstr "Bチェイン ルール番号 [オプション]" +#. type: TP +#: original/man8/iptables-extensions.8:1870 +#: original/man8/iptables-extensions.8:2461 +#, fuzzy, no-wrap +#| msgid "B<--helper >I" +msgid "B<--persistent>" +msgstr "B<--helper >I" #. type: Plain text -#: original/man8/iptables.8:40 -#, fuzzy -#| msgid "Bchain rulenum [options]" +#: original/man8/iptables-extensions.8:1875 +#: original/man8/iptables-extensions.8:2466 msgid "" -"B [B<-t> I
] {B<-F>|B<-L>|B<-Z>} [I [I]] " -"[I]" -msgstr "Bチェイン ルール番号 [オプション]" +"Gives a client the same source-/destination-address for each connection. " +"This supersedes the SAME target. Support for persistent mappings is " +"available from 2.6.29-rc2." +msgstr "" -#. type: Plain text -#: original/man8/iptables.8:42 -#, fuzzy -#| msgid "Bchain" -msgid "B [B<-t> I
] B<-N> I" -msgstr "Bチェイン" +#. type: SS +#: original/man8/iptables-extensions.8:1875 +#, no-wrap +msgid "DSCP" +msgstr "DSCP" #. type: Plain text -#: original/man8/iptables.8:44 -#, fuzzy -#| msgid "B[chain]" -msgid "B [B<-t> I
] B<-X> [I]" -msgstr "B[チェイン]" +#: original/man8/iptables-extensions.8:1879 +msgid "" +"This target allows to alter the value of the DSCP bits within the TOS header " +"of the IPv4 packet. As this manipulates a packet, it can only be used in " +"the mangle table." +msgstr "" +"このターゲットは、IPv4 パケットの TOS ヘッダーにある DSCP ビットの値の書き換" +"えを可能にする。 これはパケットを操作するので、mangle テーブルでのみ使用でき" +"る。" -#. type: Plain text -#: original/man8/iptables.8:46 -#, fuzzy -#| msgid "Bchain target [options]" -msgid "B [B<-t> I
] B<-P> I" -msgstr "Bチェイン ターゲット [オプション]" +#. type: TP +#: original/man8/iptables-extensions.8:1879 +#, fuzzy, no-wrap +#| msgid "B<--set-dscp >I" +msgid "B<--set-dscp> I" +msgstr "B<--set-dscp >I" #. type: Plain text -#: original/man8/iptables.8:48 -#, fuzzy -#| msgid "Bold-chain-name new-chain-name" -msgid "B [B<-t> I
] B<-E> I" -msgstr "B旧チェイン名 新チェイン名" +#: original/man8/iptables-extensions.8:1882 +msgid "Set the DSCP field to a numerical value (can be decimal or hex)" +msgstr "DSCP フィールドの数値を設定する (10 進または 16 進)。" + +#. type: TP +#: original/man8/iptables-extensions.8:1882 +#, fuzzy, no-wrap +#| msgid "B<--set-dscp-class >I" +msgid "B<--set-dscp-class> I" +msgstr "B<--set-dscp-class >I" + +#. type: Plain text +#: original/man8/iptables-extensions.8:1885 +msgid "Set the DSCP field to a DiffServ class." +msgstr "DSCP フィールドの DiffServ クラスを設定する。" + +#. type: SS +#: original/man8/iptables-extensions.8:1885 +#, no-wrap +msgid "ECN (IPv4-specific)" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:1888 +msgid "" +"This target allows to selectively work around known ECN blackholes. It can " +"only be used in the mangle table." +msgstr "" +"このターゲットは ECN ブラックホール問題への対処を可能にする。 mangle テーブル" +"でのみ使用できる。" + +#. type: TP +#: original/man8/iptables-extensions.8:1888 +#, no-wrap +msgid "B<--ecn-tcp-remove>" +msgstr "B<--ecn-tcp-remove>" + +#. type: Plain text +#: original/man8/iptables-extensions.8:1893 +msgid "" +"Remove all ECN bits from the TCP header. Of course, it can only be used in " +"conjunction with B<-p tcp>." +msgstr "" +"TCP ヘッダーから全ての ECN ビット (訳注: ECE/CWR フラグ) を取り除く。 当然、 " +"B<-p tcp> オプションとの組合わせでのみ使用できる。" + +#. type: SS +#: original/man8/iptables-extensions.8:1893 +#, no-wrap +msgid "HL (IPv6-specific)" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:1900 +msgid "" +"This is used to modify the Hop Limit field in IPv6 header. The Hop Limit " +"field is similar to what is known as TTL value in IPv4. Setting or " +"incrementing the Hop Limit field can potentially be very dangerous, so it " +"should be avoided at any cost. This target is only valid in B table." +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:1902 +#: original/man8/iptables-extensions.8:2613 +msgid "" +"B" +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:1902 +#, fuzzy, no-wrap +#| msgid "B<--set-mss >I" +msgid "B<--hl-set> I" +msgstr "B<--set-mss >I" + +#. type: Plain text +#: original/man8/iptables-extensions.8:1905 +msgid "Set the Hop Limit to `value'." +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:1905 +#, fuzzy, no-wrap +#| msgid "B<--dscp >I" +msgid "B<--hl-dec> I" +msgstr "B<--dscp >I" + +#. type: Plain text +#: original/man8/iptables-extensions.8:1908 +msgid "Decrement the Hop Limit `value' times." +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:1908 +#, fuzzy, no-wrap +#| msgid "B<--dscp >I" +msgid "B<--hl-inc> I" +msgstr "B<--dscp >I" + +#. type: Plain text +#: original/man8/iptables-extensions.8:1911 +msgid "Increment the Hop Limit `value' times." +msgstr "" + +#. type: SS +#: original/man8/iptables-extensions.8:1911 +#, fuzzy, no-wrap +#| msgid "MARK" +msgid "HMARK" +msgstr "MARK" + +#. type: Plain text +#: original/man8/iptables-extensions.8:1916 +msgid "" +"Like MARK, i.e. set the fwmark, but the mark is calculated from hashing " +"packet selector at choice. You have also to specify the mark range and, " +"optionally, the offset to start from. ICMP error messages are inspected and " +"used to calculate the hashing." +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:1918 +msgid "Existing options are:" +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:1918 +#, no-wrap +msgid "B<--hmark-tuple> tuple" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:1933 +msgid "" +"Possible tuple members are: B meaning source address (IPv4, IPv6 " +"address), B meaning destination address (IPv4, IPv6 address), B " +"meaning source port (TCP, UDP, UDPlite, SCTP, DCCP), B meaning " +"destination port (TCP, UDP, UDPlite, SCTP, DCCP), B meaning Security " +"Parameter Index (AH, ESP), and B meaning the usage of the conntrack " +"tuple instead of the packet selectors." +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:1933 +#, no-wrap +msgid "B<--hmark-mod> I 0)>" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:1936 +msgid "Modulus for hash calculation (to limit the range of possible marks)" +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:1936 +#, fuzzy, no-wrap +#| msgid "B<--set-mss >I" +msgid "B<--hmark-offset> I" +msgstr "B<--set-mss >I" + +#. type: Plain text +#: original/man8/iptables-extensions.8:1939 +msgid "Offset to start marks from." +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:1939 +#, no-wrap +msgid "For advanced usage, instead of using --hmark-tuple, you can specify custom" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:1942 +msgid "prefixes and masks:" +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:1942 +#, fuzzy, no-wrap +#| msgid "B<--log-prefix >I" +msgid "B<--hmark-src-prefix> I" +msgstr "B<--log-prefix >I" + +#. type: Plain text +#: original/man8/iptables-extensions.8:1945 +msgid "The source address mask in CIDR notation." +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:1945 +#, fuzzy, no-wrap +#| msgid "B<--log-prefix >I" +msgid "B<--hmark-dst-prefix> I" +msgstr "B<--log-prefix >I" + +#. type: Plain text +#: original/man8/iptables-extensions.8:1948 +msgid "The destination address mask in CIDR notation." +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:1948 +#, fuzzy, no-wrap +#| msgid "B<--set-mss >I" +msgid "B<--hmark-sport-mask> I" +msgstr "B<--set-mss >I" + +#. type: Plain text +#: original/man8/iptables-extensions.8:1951 +msgid "A 16 bit source port mask in hexadecimal." +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:1951 +#, fuzzy, no-wrap +#| msgid "B<--set-mss >I" +msgid "B<--hmark-dport-mask> I" +msgstr "B<--set-mss >I" + +#. type: Plain text +#: original/man8/iptables-extensions.8:1954 +msgid "A 16 bit destination port mask in hexadecimal." +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:1954 +#, fuzzy, no-wrap +#| msgid "B<--set-mss >I" +msgid "B<--hmark-spi-mask> I" +msgstr "B<--set-mss >I" + +#. type: Plain text +#: original/man8/iptables-extensions.8:1957 +msgid "A 32 bit field with spi mask." +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:1957 +#, fuzzy, no-wrap +#| msgid "B<--set-mss >I" +msgid "B<--hmark-proto-mask> I" +msgstr "B<--set-mss >I" + +#. type: Plain text +#: original/man8/iptables-extensions.8:1960 +msgid "An 8 bit field with layer 4 protocol number." +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:1960 +#, fuzzy, no-wrap +#| msgid "B<--dscp >I" +msgid "B<--hmark-rnd> I" +msgstr "B<--dscp >I" + +#. type: Plain text +#: original/man8/iptables-extensions.8:1963 +msgid "A 32 bit random custom value to feed hash calculation." +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:1965 +msgid "I" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:1969 +#, no-wrap +msgid "" +"iptables -t mangle -A PREROUTING -m conntrack --ctstate NEW\n" +" -j HMARK --hmark-tuple ct,src,dst,proto --hmark-offset 10000\n" +"--hmark-mod 10 --hmark-rnd 0xfeedcafe\n" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:1972 +msgid "" +"iptables -t mangle -A PREROUTING -j HMARK --hmark-offset 10000 --hmark-tuple " +"src,dst,proto --hmark-mod 10 --hmark-rnd 0xdeafbeef" +msgstr "" + +#. type: SS +#: original/man8/iptables-extensions.8:1972 +#, no-wrap +msgid "IDLETIMER" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:1981 +msgid "" +"This target can be used to identify when interfaces have been idle for a " +"certain period of time. Timers are identified by labels and are created " +"when a rule is set with a new label. The rules also take a timeout value " +"(in seconds) as an option. If more than one rule uses the same timer label, " +"the timer will be restarted whenever any of the rules get a hit. One entry " +"for each timer is created in sysfs. This attribute contains the timer " +"remaining for the timer to expire. The attributes are located under the " +"xt_idletimer class:" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:1983 +msgid "/sys/class/xt_idletimer/timers/ElabelE" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:1986 +msgid "" +"When the timer expires, the target module sends a sysfs notification to the " +"userspace, which can then decide what to do (eg. disconnect to save power)." +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:1986 +#, fuzzy, no-wrap +#| msgid "B<--limit >I" +msgid "B<--timeout> I" +msgstr "B<--limit >I" + +#. type: Plain text +#: original/man8/iptables-extensions.8:1989 +msgid "This is the time in seconds that will trigger the notification." +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:1989 +#, fuzzy, no-wrap +#| msgid "B<--helper >I" +msgid "B<--label> I" +msgstr "B<--helper >I" + +#. type: Plain text +#: original/man8/iptables-extensions.8:1993 +msgid "" +"This is a unique identifier for the timer. The maximum length for the label " +"string is 27 characters." +msgstr "" + +#. type: SS +#: original/man8/iptables-extensions.8:1993 +#, no-wrap +msgid "LED" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:1999 +msgid "" +"This creates an LED-trigger that can then be attached to system indicator " +"lights, to blink or illuminate them when certain packets pass through the " +"system. One example might be to light up an LED for a few minutes every time " +"an SSH connection is made to the local machine. The following options " +"control the trigger behavior:" +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:1999 +#, fuzzy, no-wrap +#| msgid "B<--helper >I" +msgid "B<--led-trigger-id> I" +msgstr "B<--helper >I" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2003 +msgid "" +"This is the name given to the LED trigger. The actual name of the trigger " +"will be prefixed with \"netfilter-\"." +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:2003 +#, fuzzy, no-wrap +#| msgid "B<--cmd-owner >I" +msgid "B<--led-delay> I" +msgstr "B<--cmd-owner >I" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2011 +msgid "" +"This indicates how long (in milliseconds) the LED should be left illuminated " +"when a packet arrives before being switched off again. The default is 0 " +"(blink as fast as possible.) The special value I can be given to leave " +"the LED on permanently once activated. (In this case the trigger will need " +"to be manually detached and reattached to the LED device to switch it off " +"again.)" +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:2011 +#, no-wrap +msgid "B<--led-always-blink>" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2016 +msgid "" +"Always make the LED blink on packet arrival, even if the LED is already on. " +"This allows notification of new packets even with long delay values (which " +"otherwise would result in a silent prolonging of the delay time.)" +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:2018 +#, no-wrap +msgid "Create an LED trigger for incoming SSH traffic:" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2021 +msgid "iptables -A INPUT -p tcp --dport 22 -j LED --led-trigger-id ssh" +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:2021 +#, no-wrap +msgid "Then attach the new trigger to an LED:" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2024 +msgid "echo netfilter-ssh E/sys/class/leds/I/trigger" +msgstr "" + +#. type: SS +#: original/man8/iptables-extensions.8:2024 +#, no-wrap +msgid "LOG (IPv6-specific)" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2036 +msgid "" +"Turn on kernel logging of matching packets. When this option is set for a " +"rule, the Linux kernel will print some information on all matching packets " +"(like most IPv6 IPv6-header fields) via the kernel log (where it can be read " +"with I or I(8)). This is a \"non-terminating target\", i.e. " +"rule traversal continues at the next rule. So if you want to LOG the " +"packets you refuse, use two separate rules with the same matching criteria, " +"first using target LOG then DROP (or REJECT)." +msgstr "" +"マッチしたパケットをカーネルログに記録する。 このオプションがルールに対して設" +"定されると、 Linux カーネルはマッチしたパケットについての (IPv6 における大部" +"分の IPv6 ヘッダフィールドのような) 何らかの情報を カーネルログに表示する " +"(カーネルログは I または I(8) で見ることができる)。 これは" +"「非終了タ ーゲット」である。 すなわち、ルールの検討は、次のルールへと継続さ" +"れる。 よって、拒否するパケットをログ記録したければ、 同じマッチング判断基準" +"を持つ 2 つのルールを使用し、 最初のルールで LOG ターゲットを、 次のルールで " +"DROP (または REJECT) ターゲットを指定する。" + +#. type: TP +#: original/man8/iptables-extensions.8:2036 +#: original/man8/iptables-extensions.8:2071 +#, fuzzy, no-wrap +#| msgid "B<--log-level >I" +msgid "B<--log-level> I" +msgstr "B<--log-level >I" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2042 +#: original/man8/iptables-extensions.8:2077 +msgid "" +"Level of logging, which can be (system-specific) numeric or a mnemonic. " +"Possible values are (in decreasing order of priority): B, B, " +"B, B, B, B, B or B." +msgstr "" + +#. type: TP +#: original/man8/iptables-extensions.8:2042 +#: original/man8/iptables-extensions.8:2077 +#, fuzzy, no-wrap +#| msgid "B<--log-prefix >I" +msgid "B<--log-prefix> I" +msgstr "B<--log-prefix >I" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2046 +#: original/man8/iptables-extensions.8:2081 +msgid "" +"Prefix log messages with the specified prefix; up to 29 letters long, and " +"useful for distinguishing messages in the logs." +msgstr "" +"指定したプレフィックスをログメッセージの前に付ける。\n" +"プレフィックスは 29 文字までの長さで、\n" +"ログの中でメッセージを区別するのに役立つ。" + +#. type: TP +#: original/man8/iptables-extensions.8:2046 +#: original/man8/iptables-extensions.8:2081 +#, no-wrap +msgid "B<--log-tcp-sequence>" +msgstr "B<--log-tcp-sequence>" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2050 +#: original/man8/iptables-extensions.8:2085 +msgid "" +"Log TCP sequence numbers. This is a security risk if the log is readable by " +"users." +msgstr "" +"TCP シーケンス番号をログに記録する。 ログがユーザーから読める場合、セキュリ" +"ティ上の危険がある。" + +#. type: TP +#: original/man8/iptables-extensions.8:2050 +#: original/man8/iptables-extensions.8:2085 +#, no-wrap +msgid "B<--log-tcp-options>" +msgstr "B<--log-tcp-options>" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2053 +#: original/man8/iptables-extensions.8:2088 +msgid "Log options from the TCP packet header." +msgstr "TCP パケットヘッダのオプションをログに記録する。" + +#. type: TP +#: original/man8/iptables-extensions.8:2053 +#: original/man8/iptables-extensions.8:2088 +#, no-wrap +msgid "B<--log-ip-options>" +msgstr "B<--log-ip-options>" #. type: Plain text -#: original/man8/iptables.8:50 -msgid "rule-specification = [I] [I]" +#: original/man8/iptables-extensions.8:2056 +msgid "Log options from the IPv6 packet header." +msgstr "IPv6 パケットヘッダのオプションをログに記録する。" + +#. type: TP +#: original/man8/iptables-extensions.8:2056 +#: original/man8/iptables-extensions.8:2091 +#, fuzzy, no-wrap +#| msgid "B<--log-ip-options>" +msgid "B<--log-uid>" +msgstr "B<--log-ip-options>" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2059 +#: original/man8/iptables-extensions.8:2094 +msgid "Log the userid of the process which generated the packet." +msgstr "" + +#. type: SS +#: original/man8/iptables-extensions.8:2059 +#, no-wrap +msgid "LOG (IPv4-specific)" msgstr "" #. type: Plain text -#: original/man8/iptables.8:52 -msgid "match = B<-m> I [I]" +#: original/man8/iptables-extensions.8:2071 +msgid "" +"Turn on kernel logging of matching packets. When this option is set for a " +"rule, the Linux kernel will print some information on all matching packets " +"(like most IP header fields) via the kernel log (where it can be read with " +"I or I(8)). This is a \"non-terminating target\", i.e. rule " +"traversal continues at the next rule. So if you want to LOG the packets you " +"refuse, use two separate rules with the same matching criteria, first using " +"target LOG then DROP (or REJECT)." +msgstr "" +"マッチしたパケットをカーネルログに記録する。 このオプションがルールに対して設" +"定されると、 Linux カーネルはマッチしたパケットについての (大部分の IP ヘッ" +"ダーフィールドのような) 何らかの情報を カーネルログに表示する (カーネルログ" +"は I または I(8) で見ることができる)。 これは \"非終了ター" +"ゲット\" である。 すなわち、ルールの検討は、次のルールへと継続される。 よっ" +"て、拒否するパケットをログ記録したければ、 同じマッチング判断基準を持つ 2 つ" +"のルールを使用し、 最初のルールで LOG ターゲットを、 次のルールで DROP (また" +"は REJECT) ターゲットを指定する。" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2091 +msgid "Log options from the IP packet header." +msgstr "IP パケットヘッダーのオプションをログに記録する。" + +#. type: SS +#: original/man8/iptables-extensions.8:2094 +#, no-wrap +msgid "MARK" +msgstr "MARK" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2100 +msgid "" +"This target is used to set the Netfilter mark value associated with the " +"packet. It can, for example, be used in conjunction with routing based on " +"fwmark (needs iproute2). If you plan on doing so, note that the mark needs " +"to be set in the PREROUTING chain of the mangle table to affect routing. " +"The mark field is 32 bits wide." msgstr "" #. type: Plain text -#: original/man8/iptables.8:54 -msgid "target = B<-j> I [I]" +#: original/man8/iptables-extensions.8:2104 +msgid "" +"Zeroes out the bits given by I and XORs I into the packet mark " +"(\"nfmark\"). If I is omitted, 0xFFFFFFFF is assumed." msgstr "" #. type: Plain text -#: original/man8/iptables.8:60 +#: original/man8/iptables-extensions.8:2108 +msgid "" +"Zeroes out the bits given by I and ORs I into the packet mark. " +"If I is omitted, 0xFFFFFFFF is assumed." +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2110 +#: original/man8/iptables-extensions.8:2545 +msgid "The following mnemonics are available:" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2114 +msgid "" +"Binary AND the nfmark with I. (Mnemonic for B<--set-xmark 0/" +">I, where I is the binary negation of I.)" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2118 +msgid "" +"Binary OR the nfmark with I. (Mnemonic for B<--set-xmark> IBI.)" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2122 +msgid "" +"Binary XOR the nfmark with I. (Mnemonic for B<--set-xmark> " +"IB.)" +msgstr "" + +#. type: SS +#: original/man8/iptables-extensions.8:2122 +#, no-wrap +msgid "MASQUERADE (IPv6-specific)" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2136 #, fuzzy #| msgid "" -#| "B is used to set up, maintain, and inspect the tables of IP " -#| "packet filter rules in the Linux kernel. Several different tables may be " -#| "defined. Each table contains a number of built-in chains and may also " -#| "contain user-defined chains." +#| "This target is only valid in the B table, in the B " +#| "chain. It should only be used with dynamically assigned IP (dialup) " +#| "connections: if you have a static IP address, you should use the SNAT " +#| "target. Masquerading is equivalent to specifying a mapping to the IP " +#| "address of the interface the packet is going out, but also has the effect " +#| "that connections are I when the interface goes down. This is " +#| "the correct behavior when the next dialup is unlikely to have the same " +#| "interface address (and hence any established connections are lost " +#| "anyway). It takes one option:" msgid "" -"B is used to set up, maintain, and inspect the tables of IPv4 " -"packet filter rules in the Linux kernel. Several different tables may be " -"defined. Each table contains a number of built-in chains and may also " -"contain user-defined chains." +"This target is only valid in the B table, in the B chain. " +"It should only be used with dynamically assigned IPv6 (dialup) connections: " +"if you have a static IP address, you should use the SNAT target. " +"Masquerading is equivalent to specifying a mapping to the IP address of the " +"interface the packet is going out, but also has the effect that connections " +"are I when the interface goes down. This is the correct behavior " +"when the next dialup is unlikely to have the same interface address (and " +"hence any established connections are lost anyway)." msgstr "" -"B は Linux カーネルの IP パケットフィルタルールのテーブルを 設定・" -"管理・検査するために使われる。 複数の異なるテーブルを定義できる。 各テーブル" -"にはたくさんの組み込み済みチェインが含まれており、 さらにユーザー定義のチェイ" -"ンを加えることもできる。" +"このターゲットは B テーブルの B チェインのみで有効である。 " +"動的割り当て IP (ダイヤルアップ) 接続の場合にのみ使うべきである。 固定 IP ア" +"ドレスならば、SNAT ターゲットを使うべきである。 マスカレーディングは、パケッ" +"トが送信されるインターフェースの IP アドレスへのマッピングを指定するのと同じ" +"であるが、 インターフェースが停止した場合に接続をI<忘れる>という効果がある。 " +"次のダイヤルアップでは同じインターフェースアドレスになる可能性が低い (そのた" +"め、前回確立された接続は失われる) 場合、 この動作は正しい。 このターゲットに" +"はオプションが 1 つある。" #. type: TP -#: original/man8/iptables.8:107 -#, no-wrap -msgid "B:" -msgstr "B:" +#: original/man8/iptables-extensions.8:2136 +#: original/man8/iptables-extensions.8:2167 +#: original/man8/iptables-extensions.8:2291 +#, fuzzy, no-wrap +#| msgid "B<--to-ports >I[-I]" +msgid "B<--to-ports> I[B<->I]" +msgstr "B<--to-ports >I[-I]" #. type: Plain text -#: original/man8/iptables.8:114 +#: original/man8/iptables-extensions.8:2145 +#: original/man8/iptables-extensions.8:2176 msgid "" -"This table is consulted when a packet that creates a new connection is " -"encountered. It consists of three built-ins: B (for altering " -"packets as soon as they come in), B (for altering locally-generated " -"packets before routing), and B (for altering packets as they " -"are about to go out)." +"This specifies a range of source ports to use, overriding the default " +"B source port-selection heuristics (see above). This is only valid if " +"the rule also specifies B<-p tcp> or B<-p udp>." msgstr "" -"このテーブルは新しい接続を開くようなパケットに対して参照される。 これには " -"B (パケットが入ってきた場合、すぐにそのパケットを変換するための" -"チェイン)・ B (ローカルで生成されたパケットをルーティングの前に変換す" -"るためのチェイン)・ B (パケットが出て行くときに変換するための" -"チェイン) という 3 つの組み込み済みチェインが含まれる。" +"このオプションは、使用する送信元ポートの範囲を指定し、 デフォルトの B " +"送信元ポートの選択方法 (上記) よりも優先される。 ルールが B<-p tcp> または " +"B<-p udp> を指定している場合にのみ有効である。" #. type: Plain text -#: original/man8/iptables.8:147 +#: original/man8/iptables-extensions.8:2151 msgid "" -"The options that are recognized by B can be divided into several " -"different groups." -msgstr "B で使えるオプションは、いくつかのグループに分けられる。" +"Randomize source port mapping If option B<--random> is used then port " +"mapping will be randomized." +msgstr "" + +#. type: SS +#: original/man8/iptables-extensions.8:2153 +#, no-wrap +msgid "MASQUERADE (IPv4-specific)" +msgstr "" #. type: Plain text -#: original/man8/iptables.8:153 +#: original/man8/iptables-extensions.8:2167 #, fuzzy #| msgid "" -#| "These options specify the specific action to perform. Only one of them " -#| "can be specified on the command line unless otherwise specified below. " -#| "For all the long versions of the command and option names, you need to " -#| "use only enough letters to ensure that B can differentiate it " -#| "from all other options." +#| "This target is only valid in the B table, in the B " +#| "chain. It should only be used with dynamically assigned IP (dialup) " +#| "connections: if you have a static IP address, you should use the SNAT " +#| "target. Masquerading is equivalent to specifying a mapping to the IP " +#| "address of the interface the packet is going out, but also has the effect " +#| "that connections are I when the interface goes down. This is " +#| "the correct behavior when the next dialup is unlikely to have the same " +#| "interface address (and hence any established connections are lost " +#| "anyway). It takes one option:" msgid "" -"These options specify the desired action to perform. Only one of them can be " -"specified on the command line unless otherwise stated below. For long " -"versions of the command and option names, you need to use only enough " -"letters to ensure that B can differentiate it from all other " -"options." +"This target is only valid in the B table, in the B chain. " +"It should only be used with dynamically assigned IP (dialup) connections: " +"if you have a static IP address, you should use the SNAT target. " +"Masquerading is equivalent to specifying a mapping to the IP address of the " +"interface the packet is going out, but also has the effect that connections " +"are I when the interface goes down. This is the correct behavior " +"when the next dialup is unlikely to have the same interface address (and " +"hence any established connections are lost anyway)." msgstr "" -"これらのオプションは、実行する特定の動作を指定する。 以下の説明で注記されてい" -"ない限り、 コマンドラインで指定できるのはこの中の 1 つだけである。 長いバー" -"ジョンのコマンド名とオプション名は、 B が他のコマンド名やオプション" -"名と区別できる範囲で (文字を省略して) 指定することもできる。" +"このターゲットは B テーブルの B チェインのみで有効である。 " +"動的割り当て IP (ダイヤルアップ) 接続の場合にのみ使うべきである。 固定 IP ア" +"ドレスならば、SNAT ターゲットを使うべきである。 マスカレーディングは、パケッ" +"トが送信されるインターフェースの IP アドレスへのマッピングを指定するのと同じ" +"であるが、 インターフェースが停止した場合に接続をI<忘れる>という効果がある。 " +"次のダイヤルアップでは同じインターフェースアドレスになる可能性が低い (そのた" +"め、前回確立された接続は失われる) 場合、 この動作は正しい。 このターゲットに" +"はオプションが 1 つある。" #. type: Plain text -#: original/man8/iptables.8:188 +#: original/man8/iptables-extensions.8:2182 +msgid "" +"Randomize source port mapping If option B<--random> is used then port " +"mapping will be randomized (kernel E= 2.6.21)." +msgstr "" + +#. type: SS +#: original/man8/iptables-extensions.8:2184 +#, no-wrap +msgid "MIRROR (IPv4-specific)" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2197 +msgid "" +"This is an experimental demonstration target which inverts the source and " +"destination fields in the IP header and retransmits the packet. It is only " +"valid in the B, B and B chains, and user-defined " +"chains which are only called from those chains. Note that the outgoing " +"packets are B seen by any packet filtering chains, connection tracking " +"or NAT, to avoid loops and other problems." +msgstr "" +"実験的なデモンストレーション用のターゲットであり、 IP ヘッダーの送信元と送信" +"先フィールドを入れ換え、 パケットを再送信するものである。 これは B, " +"B, B チェインと、これらのチェインから呼び出される ユー" +"ザー定義チェインだけで有効である。 ループ等の問題を回避するため、外部に送られ" +"るパケットは いかなるパケットフィルタリングチェイン・接続追跡・NAT からも 監" +"視B<されない>。" + +#. type: SS +#: original/man8/iptables-extensions.8:2197 +#, no-wrap +msgid "NETMAP (IPv4-specific)" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2202 #, fuzzy #| msgid "" -#| "List all rules in the selected chain. If no chain is selected, all " -#| "chains are listed. As every other iptables command, it applies to the " -#| "specified table (filter is the default), so NAT rules get listed by" +#| "This target allows to selectively work around known ECN blackholes. It " +#| "can only be used in the mangle table." msgid "" -"List all rules in the selected chain. If no chain is selected, all chains " -"are listed. Like every other iptables command, it applies to the specified " -"table (filter is the default), so NAT rules get listed by" +"This target allows you to statically map a whole network of addresses onto " +"another network of addresses. It can only be used from rules in the B " +"table." msgstr "" -"選択されたチェインにある全てのルールを一覧表示する。 チェインが指定されない場" -"合、全てのチェインにあるリストが一覧表示される。 他の各 iptables コマンドと同" -"様に、指定されたテーブル (デフォルトは filter) に対して作用する。 よって NAT " -"ルールを表示するには以下のようにする。" +"このターゲットは ECN ブラックホール問題への対処を可能にする。 mangle テーブル" +"でのみ使用できる。" + +#. type: TP +#: original/man8/iptables-extensions.8:2202 +#, fuzzy, no-wrap +#| msgid "B<-s, --source >[!] I
[/I]" +msgid "B<--to> I
[BI]" +msgstr "B<-s, --source >[!] I
[/I]" #. type: Plain text -#: original/man8/iptables.8:190 -#, no-wrap -msgid " iptables -t nat -n -L\n" -msgstr " iptables -t nat -n -L\n" +#: original/man8/iptables-extensions.8:2207 +msgid "" +"Network address to map to. The resulting address will be constructed in the " +"following way: All 'one' bits in the mask are filled in from the new " +"`address'. All bits that are zero in the mask are filled in from the " +"original address." +msgstr "" -#. type: Plain text -#: original/man8/iptables.8:199 +#. type: SS +#: original/man8/iptables-extensions.8:2207 #, no-wrap -msgid " iptables -L -v\n" -msgstr " iptables -L -v\n" +msgid "NFLOG" +msgstr "" #. type: Plain text -#: original/man8/iptables.8:205 +#: original/man8/iptables-extensions.8:2217 #, fuzzy #| msgid "" -#| "List all rules in the selected chain. If no chain is selected, all " -#| "chains are listed. As every other iptables command, it applies to the " -#| "specified table (filter is the default), so NAT rules get listed by" +#| "This target provides userspace logging of matching packets. When this " +#| "target is set for a rule, the Linux kernel will multicast this packet " +#| "through a I socket. One or more userspace processes may then " +#| "subscribe to various multicast groups and receive the packets. Like LOG, " +#| "this is a \"non-terminating target\", i.e. rule traversal continues at " +#| "the next rule." msgid "" -"Print all rules in the selected chain. If no chain is selected, all chains " -"are printed like iptables-save. Like every other iptables command, it " -"applies to the specified table (filter is the default)." +"This target provides logging of matching packets. When this target is set " +"for a rule, the Linux kernel will pass the packet to the loaded logging " +"backend to log the packet. This is usually used in combination with " +"nfnetlink_log as logging backend, which will multicast the packet through a " +"I socket to the specified multicast group. One or more userspace " +"processes may subscribe to the group to receive the packets. Like LOG, this " +"is a non-terminating target, i.e. rule traversal continues at the next rule." msgstr "" -"選択されたチェインにある全てのルールを一覧表示する。 チェインが指定されない場" -"合、全てのチェインにあるリストが一覧表示される。 他の各 iptables コマンドと同" -"様に、指定されたテーブル (デフォルトは filter) に対して作用する。 よって NAT " -"ルールを表示するには以下のようにする。" +"このターゲットは、マッチしたパケットを ユーザー空間でログ記録する機能を提供す" +"る。 このターゲットがルールに設定されると、 Linux カーネルは、そのパケットを " +"I ソケットを用いてマルチキャストする。 そして、1 つ以上のユーザー空" +"間プロセスが いろいろなマルチキャストグループに登録をおこない、 パケットを受" +"信する。 LOG と同様、これは \"非終了ターゲット\" であり、 ルールの検討は次の" +"ルールへと継続される。" + +#. type: TP +#: original/man8/iptables-extensions.8:2217 +#, fuzzy, no-wrap +#| msgid "B<--ulog-nlgroup >I" +msgid "B<--nflog-group> I" +msgstr "B<--ulog-nlgroup >I" #. type: Plain text -#: original/man8/iptables.8:256 +#: original/man8/iptables-extensions.8:2221 #, fuzzy #| msgid "" -#| "The protocol of the rule or of the packet to check. The specified " -#| "protocol can be one of I, I, I, or I, or it can be a " -#| "numeric value, representing one of these protocols or a different one. A " -#| "protocol name from /etc/protocols is also allowed. A \"!\" argument " -#| "before the protocol inverts the test. The number zero is equivalent to " -#| "I. Protocol I will match with all protocols and is taken as " -#| "default when this option is omitted." +#| "This specifies the netlink group (1-32) to which the packet is sent. " +#| "Default value is 1." msgid "" -"The protocol of the rule or of the packet to check. The specified protocol " -"can be one of B, B, B, B, B, B, B or " -"the special keyword \"B\", or it can be a numeric value, representing " -"one of these protocols or a different one. A protocol name from /etc/" -"protocols is also allowed. A \"!\" argument before the protocol inverts the " -"test. The number zero is equivalent to B. \"B\" will match with " -"all protocols and is taken as default when this option is omitted." +"The netlink group (0 - 2^16-1) to which packets are (only applicable for " +"nfnetlink_log). The default value is 0." msgstr "" -"ルールで使われるプロトコル、またはチェックされるパケットのプロトコル。 指定で" -"きるプロトコルは、 I, I, I, I のいずれか 1 つか、数値で" -"ある。 数値には、これらのプロトコルのどれかないし別のプロトコルを表す 数値を" -"指定することができる。 /etc/protocols にあるプロトコル名も指定できる。 プロト" -"コルの前に \"!\" を置くと、そのプロトコルを除外するという意味になる。 数値 0 " -"は I と等しい。 プロトコル I は全てのプロトコルとマッチし、 このオ" -"プションが省略された際のデフォルトである。" +"パケットを送信する netlink グループ (1-32) を指定する。 デフォルトの値は 1 で" +"ある。" #. type: TP -#: original/man8/iptables.8:256 +#: original/man8/iptables-extensions.8:2221 #, fuzzy, no-wrap -#| msgid "B<-s, --source >[!] I
[/I]" -msgid "[B] B<-s>, B<--source> I
[BI][B<,>I<...>]" -msgstr "B<-s, --source >[!] I
[/I]" +#| msgid "B<--log-prefix >I" +msgid "B<--nflog-prefix> I" +msgstr "B<--log-prefix >I" #. type: Plain text -#: original/man8/iptables.8:273 +#: original/man8/iptables-extensions.8:2225 #, fuzzy #| msgid "" -#| "Source specification. I
can be either a network name, a " -#| "hostname (please note that specifying any name to be resolved with a " -#| "remote query such as DNS is a really bad idea), a network IP address " -#| "(with /mask), or a plain IP address. The I can be either a network " -#| "mask or a plain number, specifying the number of 1's at the left side of " -#| "the network mask. Thus, a mask of I<24> is equivalent to " -#| "I<255.255.255.0>. A \"!\" argument before the address specification " -#| "inverts the sense of the address. The flag B<--src> is an alias for this " -#| "option." +#| "Prefix log messages with the specified prefix; up to 32 characters long, " +#| "and useful for distinguishing messages in the logs." msgid "" -"Source specification. I
can be either a network name, a hostname, a " -"network IP address (with BI), or a plain IP address. Hostnames will " -"be resolved once only, before the rule is submitted to the kernel. Please " -"note that specifying any name to be resolved with a remote query such as DNS " -"is a really bad idea. The I can be either a network mask or a plain " -"number, specifying the number of 1's at the left side of the network mask. " -"Thus, a mask of I<24> is equivalent to I<255.255.255.0>. A \"!\" argument " -"before the address specification inverts the sense of the address. The flag " -"B<--src> is an alias for this option. Multiple addresses can be specified, " -"but this will B (when adding with -A), or will " -"cause multiple rules to be deleted (with -D)." +"A prefix string to include in the log message, up to 64 characters long, " +"useful for distinguishing messages in the logs." msgstr "" -"送信元の指定。 I
はホスト名 (DNS のようなリモートへの問い合わせで解" -"決する名前を指定するのは非常に良くない) ・ネットワーク IP アドレス (/mask を" -"指定する)・ 通常の IP アドレス、のいずれかである。 I はネットワークマス" -"クか、 ネットワークマスクの左側にある 1 の数を指定する数値である。 つまり、 " -"I<24> という mask は I<255.255.255.0> に等しい。 アドレス指定の前に \"!\" を" -"置くと、そのアドレスを除外するという意味になる。 フラグ B<--src> は、このオプ" -"ションの別名である。" +"指定したプレフィックスをログメッセージの前に付ける。 32 文字までの指定でき" +"る。 ログの中でメッセージを区別するのに便利である。" #. type: TP -#: original/man8/iptables.8:273 +#: original/man8/iptables-extensions.8:2225 #, fuzzy, no-wrap -#| msgid "B<-d, --destination >[!] I
[/I]" -msgid "[B] B<-d>, B<--destination> I
[BI][B<,>I<...>]" -msgstr "B<-d, --destination >[!] I
[/I]" +#| msgid "B<--ulog-cprange >I" +msgid "B<--nflog-range> I" +msgstr "B<--ulog-cprange >I" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2230 +msgid "" +"The number of bytes to be copied to userspace (only applicable for " +"nfnetlink_log). nfnetlink_log instances may specify their own range, this " +"option overrides it." +msgstr "" #. type: TP -#: original/man8/iptables.8:312 +#: original/man8/iptables-extensions.8:2230 #, fuzzy, no-wrap -#| msgid "B<[!] -f, --fragment>" -msgid "[B] B<-f>, B<--fragment>" -msgstr "B<[!] -f, --fragment>" +#| msgid "B<--ulog-qthreshold >I" +msgid "B<--nflog-threshold> I" +msgstr "B<--ulog-qthreshold >I" #. type: Plain text -#: original/man8/iptables.8:320 +#: original/man8/iptables-extensions.8:2237 msgid "" -"This means that the rule only refers to second and further fragments of " -"fragmented packets. Since there is no way to tell the source or destination " -"ports of such a packet (or ICMP type), such a packet will not match any " -"rules which specify them. When the \"!\" argument precedes the \"-f\" flag, " -"the rule will only match head fragments, or unfragmented packets." +"Number of packets to queue inside the kernel before sending them to " +"userspace (only applicable for nfnetlink_log). Higher values result in less " +"overhead per packet, but increase delay until the packets reach userspace. " +"The default value is 1." +msgstr "" + +#. type: SS +#: original/man8/iptables-extensions.8:2237 +#, no-wrap +msgid "NFQUEUE" msgstr "" -"このオプションは、分割されたパケット (fragmented packet) のうち 2 番目以降の" -"パケットだけを参照するルールであることを意味する。 このようなパケット (また" -"は ICMP タイプのパケット) は 送信元・送信先ポートを知る方法がないので、 送信" -"元や送信先を指定するようなルールにはマッチしない。 \"-f\" フラグの前に \"!\" " -"を置くと、 分割されたパケットのうち最初のものか、 分割されていないパケットだ" -"けにマッチする。" #. type: Plain text -#: original/man8/iptables.8:368 -#, fuzzy -#| msgid "" -#| "iptables can use extended packet matching modules. These are loaded in " -#| "two ways: implicitly, when B<-p> or B<--protocol> is specified, or with " -#| "the B<-m> or B<--match> options, followed by the matching module name; " -#| "after these, various extra command line options become available, " -#| "depending on the specific module. You can specify multiple extended " -#| "match modules in one line, and you can use the B<-h> or B<--help> options " -#| "after the module has been specified to receive help specific to that " -#| "module." +#: original/man8/iptables-extensions.8:2247 msgid "" -"iptables can use extended packet matching modules with the B<-m> or B<--" -"match> options, followed by the matching module name; after these, various " -"extra command line options become available, depending on the specific " -"module. You can specify multiple extended match modules in one line, and " -"you can use the B<-h> or B<--help> options after the module has been " -"specified to receive help specific to that module." +"This target is an extension of the QUEUE target. As opposed to QUEUE, it " +"allows you to put a packet into any specific queue, identified by its 16-bit " +"queue number. It can only be used with Kernel versions 2.6.14 or later, " +"since it requires the B kernel support. The B option was added in Linux 2.6.31, B in 2.6.39." msgstr "" -"iptables は拡張されたパケットマッチングモジュールを使うことができる。 これら" -"のモジュールは 2 種類の方法でロードされる: モジュールは、 B<-p> または B<--" -"protocol> で暗黙のうちに指定されるか、 B<-m> または B<--match> の後にモジュー" -"ル名を続けて指定される。 これらのモジュールの後ろには、モジュールに応じて 他" -"のいろいろなコマンドラインオプションを指定することができる。 複数の拡張マッチ" -"ングモジュールを一行で指定することができる。 また、モジュールに特有のヘルプを" -"表示させるためには、 モジュールを指定した後で B<-h> または B<--help> を指定す" -"ればよい。" -#. @MATCH@ +#. type: TP +#: original/man8/iptables-extensions.8:2247 +#, fuzzy, no-wrap +#| msgid "B<--set-mss >I" +msgid "B<--queue-num> I" +msgstr "B<--set-mss >I" + #. type: Plain text -#: original/man8/iptables.8:373 +#: original/man8/iptables-extensions.8:2250 msgid "" -"If the B<-p> or B<--protocol> was specified and if and only if an unknown " -"option is encountered, iptables will try load a match module of the same " -"name as the protocol, to try making the option available." +"This specifies the QUEUE number to use. Valid queue numbers are 0 to 65535. " +"The default value is 0." msgstr "" +#. type: TP +#: original/man8/iptables-extensions.8:2251 +#, fuzzy, no-wrap +#| msgid "B<--mss >I[:I]" +msgid "B<--queue-balance> IB<:>I" +msgstr "B<--mss >I[:I]" + #. type: Plain text -#: original/man8/iptables.8:445 -#, fuzzy -#| msgid "This module matches the SPIs in AH header of IPSec packets." -msgid "This module matches the SPIs in Authentication header of IPsec packets." -msgstr "このモジュールは IPSec パケットの AH ヘッダーの SPI 値にマッチする。" +#: original/man8/iptables-extensions.8:2257 +msgid "" +"This specifies a range of queues to use. Packets are then balanced across " +"the given queues. This is useful for multicore systems: start multiple " +"instances of the userspace program on queues x, x+1, .. x+n and use \"--" +"queue-balance IB<:>I\". Packets belonging to the same connection " +"are put into the same nfqueue." +msgstr "" -#. type: SS -#: original/man8/iptables.8:825 +#. type: TP +#: original/man8/iptables-extensions.8:2258 #, no-wrap -msgid "icmp" -msgstr "icmp" +msgid "B<--queue-bypass>" +msgstr "" #. type: Plain text -#: original/man8/iptables.8:828 -#, fuzzy -#| msgid "" -#| "This extension is loaded if `--protocol icmp' is specified. It provides " -#| "the following option:" +#: original/man8/iptables-extensions.8:2263 msgid "" -"This extension can be used if `--protocol icmp' is specified. It provides " -"the following option:" +"By default, if no userspace program is listening on an NFQUEUE, then all " +"packets that are to be queued are dropped. When this option is used, the " +"NFQUEUE rule is silently bypassed instead. The packet will move on to the " +"next rule." msgstr "" -"この拡張は `--protocol icmp' が指定された場合にロードされ、 以下のオプション" -"が提供される:" -#. type: TP -#: original/man8/iptables.8:828 -#, fuzzy, no-wrap -#| msgid "B<--icmp-type >[!] I" -msgid "[B] B<--icmp-type> {I[BI]|I}" -msgstr "B<--icmp-type >[!] I" +#. type: SS +#: original/man8/iptables-extensions.8:2263 +#, no-wrap +msgid "NOTRACK" +msgstr "" #. type: Plain text -#: original/man8/iptables.8:832 -#, fuzzy -#| msgid "" -#| "This allows specification of the ICMP type, which can be a numeric ICMP " -#| "type, or one of the ICMP type names shown by the command" +#: original/man8/iptables-extensions.8:2267 msgid "" -"This allows specification of the ICMP type, which can be a numeric ICMP " -"type, type/code pair, or one of the ICMP type names shown by the command" +"This target disables connection tracking for all packets matching that " +"rule. It is obsoleted by -j CT --notrack. Like CT, NOTRACK can only be used " +"in the B table." msgstr "" -"ICMP タイプを指定できる。タイプ指定には、 数値の ICMP タイプ、または以下のコ" -"マンド で表示される ICMP タイプ名を指定できる。" -#. type: Plain text -#: original/man8/iptables.8:834 +#. type: SS +#: original/man8/iptables-extensions.8:2267 #, no-wrap -msgid " iptables -p icmp -h\n" -msgstr " iptables -p icmp -h\n" +msgid "RATEEST" +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2270 +msgid "" +"The RATEEST target collects statistics, performs rate estimation calculation " +"and saves the results for later evaluation using the B match." +msgstr "" -#. type: SS -#: original/man8/iptables.8:969 +#. type: TP +#: original/man8/iptables-extensions.8:2270 #, fuzzy, no-wrap -#| msgid "tos" -msgid "osf" -msgstr "tos" +#| msgid "B<--ctstate >I" +msgid "B<--rateest-name> I" +msgstr "B<--ctstate >I" #. type: Plain text -#: original/man8/iptables.8:973 +#: original/man8/iptables-extensions.8:2274 msgid "" -"The osf module does passive operating system fingerprinting. This modules " -"compares some data (Window Size, MSS, options and their order, TTL, DF, and " -"others) from packets with the SYN bit set." +"Count matched packets into the pool referred to by I, which is freely " +"choosable." msgstr "" #. type: TP -#: original/man8/iptables.8:973 -#, fuzzy, no-wrap -#| msgid "B<--helper >I" -msgid "[B] B<--genre> I" -msgstr "B<--helper >I" +#: original/man8/iptables-extensions.8:2274 +#, no-wrap +msgid "B<--rateest-interval> I{B|B|B}" +msgstr "" #. type: Plain text -#: original/man8/iptables.8:976 -msgid "Match an operating system genre by using a passive fingerprinting." +#: original/man8/iptables-extensions.8:2277 +msgid "Rate measurement interval, in seconds, milliseconds or microseconds." msgstr "" #. type: TP -#: original/man8/iptables.8:976 +#: original/man8/iptables-extensions.8:2277 #, fuzzy, no-wrap -#| msgid "B<--ttl >I" -msgid "B<--ttl> I" -msgstr "B<--ttl >I" +#| msgid "B<--set-mss >I" +msgid "B<--rateest-ewmalog> I" +msgstr "B<--set-mss >I" #. type: Plain text -#: original/man8/iptables.8:980 -msgid "" -"Do additional TTL checks on the packet to determine the operating system. " -"I can be one of the following values:" +#: original/man8/iptables-extensions.8:2280 +msgid "Rate measurement averaging time constant." +msgstr "" + +#. type: SS +#: original/man8/iptables-extensions.8:2280 +#, no-wrap +msgid "REDIRECT (IPv4-specific)" msgstr "" #. type: Plain text -#: original/man8/iptables.8:983 +#: original/man8/iptables-extensions.8:2291 +#, fuzzy +#| msgid "" +#| "This target is only valid in the B table, in the B and " +#| "B chains, and user-defined chains which are only called from " +#| "those chains. It alters the destination IP address to send the packet to " +#| "the machine itself (locally-generated packets are mapped to the 127.0.0.1 " +#| "address). It takes one option:" msgid "" -"0 - True IP address and fingerprint TTL comparison. This generally works for " -"LANs." +"This target is only valid in the B table, in the B and " +"B chains, and user-defined chains which are only called from those " +"chains. It redirects the packet to the machine itself by changing the " +"destination IP to the primary address of the incoming interface (locally-" +"generated packets are mapped to the 127.0.0.1 address)." msgstr "" +"このターゲットは、 B テーブル内の B チェイン及び B " +"チェイン、そしてこれらチェインから呼び出される ユーザー定義チェインでのみ有効" +"である。 このターゲットはパケットの送信先 IP アドレスを マシン自身の IP アド" +"レスに変換する。 (ローカルで生成されたパケットは、アドレス 127.0.0.1 にマップ" +"される)。 このターゲットにはオプションが 1 つある:" #. type: Plain text -#: original/man8/iptables.8:986 +#: original/man8/iptables-extensions.8:2299 msgid "" -"1 - Check if the IP header's TTL is less than the fingerprint one. Works for " -"globally-routable addresses." +"This specifies a destination port or range of ports to use: without this, " +"the destination port is never altered. This is only valid if the rule also " +"specifies B<-p tcp> or B<-p udp>." +msgstr "" +"このオプションは使用される送信先ポート・ポート範囲・複数ポートを指定する。 こ" +"のオプションが指定されない場合、送信先ポートは変更されない。 ルールが B<-p " +"tcp> または B<-p udp> を指定している場合にのみ有効である。" + +#. type: SS +#: original/man8/iptables-extensions.8:2306 +#, no-wrap +msgid "REJECT (IPv6-specific)" msgstr "" #. type: Plain text -#: original/man8/iptables.8:988 -msgid "2 - Do not compare the TTL at all." +#: original/man8/iptables-extensions.8:2319 +#: original/man8/iptables-extensions.8:2353 +msgid "" +"This is used to send back an error packet in response to the matched packet: " +"otherwise it is equivalent to B so it is a terminating TARGET, ending " +"rule traversal. This target is only valid in the B, B and " +"B chains, and user-defined chains which are only called from those " +"chains. The following option controls the nature of the error packet " +"returned:" msgstr "" +"マッチしたパケットの応答としてエラーパケットを送信するために使われる。\n" +"エラーパケットを送らなければ、 B と同じであり、TARGET を終了し、\n" +"ルールの検討を終了する。 このターゲットは、 B, B,\n" +"B チェインと、これらのチェインから呼ばれる ユーザー定義チェイン\n" +"だけで有効である。以下のオプションは、返されるエラーパケットの特性を\n" +"制御する。" #. type: TP -#: original/man8/iptables.8:988 +#: original/man8/iptables-extensions.8:2319 +#: original/man8/iptables-extensions.8:2353 #, fuzzy, no-wrap -#| msgid "B<--log-level >I" -msgid "B<--log> I" -msgstr "B<--log-level >I" +#| msgid "B<--reject-with >I" +msgid "B<--reject-with> I" +msgstr "B<--reject-with >I" #. type: Plain text -#: original/man8/iptables.8:992 +#: original/man8/iptables-extensions.8:2340 +#, fuzzy +#| msgid "" +#| "which return the appropriate IPv6-ICMP error message (B is " +#| "the default). Finally, the option B can be used on rules which " +#| "only match the TCP protocol: this causes a TCP RST packet to be sent " +#| "back. This is mainly useful for blocking I (113/tcp) probes which " +#| "frequently occur when sending mail to broken mail hosts (which won't " +#| "accept your mail otherwise)." msgid "" -"Log determined genres into dmesg even if they do not match the desired one. " -"I can be one of the following values:" +"The type given can be B, B, B, B, B, B, " +"B or B which return the appropriate " +"ICMPv6 error message (B is the default). Finally, the option " +"B can be used on rules which only match the TCP protocol: this " +"causes a TCP RST packet to be sent back. This is mainly useful for blocking " +"I (113/tcp) probes which frequently occur when sending mail to broken " +"mail hosts (which won't accept your mail otherwise). B can only " +"be used with kernel versions 2.6.14 or later." msgstr "" +"であり、適切な IPv6-ICMP エラーメッセージを返す (B がデフォルト" +"である)。 さらに、TCP プロトコルにのみマッチするルールに対して、オプション " +"B を使うことができる。 このオプションを使うと、TCP RST パケットが" +"送り返される。 主として I (113/tcp) による探査を阻止するのに役立つ。 " +"I による探査は、壊れている (メールを受け取らない) メールホストに メー" +"ルが送られる場合に頻繁に起こる。" -#. type: Plain text -#: original/man8/iptables.8:994 -msgid "0 - Log all matched or unknown signatures" +#. type: SS +#: original/man8/iptables-extensions.8:2340 +#, no-wrap +msgid "REJECT (IPv4-specific)" msgstr "" #. type: Plain text -#: original/man8/iptables.8:996 -msgid "1 - Log only the first one" +#: original/man8/iptables-extensions.8:2371 +#, fuzzy +#| msgid "" +#| "which return the appropriate ICMP error message (B is " +#| "the default). The option B can be used on rules which only " +#| "match the TCP protocol: this causes a TCP RST packet to be sent back. " +#| "This is mainly useful for blocking I (113/tcp) probes which " +#| "frequently occur when sending mail to broken mail hosts (which won't " +#| "accept your mail otherwise)." +msgid "" +"The type given can be B, B, " +"B, B, B, " +"B or B (*) which return the " +"appropriate ICMP error message (B is the default). The " +"option B can be used on rules which only match the TCP protocol: " +"this causes a TCP RST packet to be sent back. This is mainly useful for " +"blocking I (113/tcp) probes which frequently occur when sending mail " +"to broken mail hosts (which won't accept your mail otherwise)." msgstr "" +"であり、適切な ICMP エラーメッセージを返す (B がデフォルト" +"である)。 TCP プロトコルにのみマッチするルールに対して、オプション B を使うことができる。 このオプションを使うと、TCP RST パケットが送り返" +"される。 主として I (113/tcp) による探査を阻止するのに役立つ。 " +"I による探査は、壊れている (メールを受け取らない) メールホストに メー" +"ルが送られる場合に頻繁に起こる。" #. type: Plain text -#: original/man8/iptables.8:998 -msgid "2 - Log all known matched signatures" +#: original/man8/iptables-extensions.8:2373 +msgid "" +"(*) Using icmp-admin-prohibited with kernels that do not support it will " +"result in a plain DROP instead of REJECT" msgstr "" +"(*) icmp-admin-prohibited をサポートしないカーネルで、 icmp-admin-prohibited " +"を使用すると、 REJECT ではなく単なる DROP になる。" -#. type: Plain text -#: original/man8/iptables.8:1000 -msgid "You may find something like this in syslog:" +#. type: SS +#: original/man8/iptables-extensions.8:2373 +#, no-wrap +msgid "SAME (IPv4-specific)" msgstr "" #. type: Plain text -#: original/man8/iptables.8:1003 +#: original/man8/iptables-extensions.8:2377 msgid "" -"Windows [2000:SP3:Windows XP Pro SP1, 2000 SP3]: 11.22.33.55:4024 -E " -"11.22.33.44:139 hops=3 Linux [2.5-2.6:] : 1.2.3.4:42624 -E 1.2.3.5:22 " -"hops=4" +"Similar to SNAT/DNAT depending on chain: it takes a range of addresses (`--" +"to 1.2.3.4-1.2.3.7') and gives a client the same source-/destination-address " +"for each connection." msgstr "" #. type: Plain text -#: original/man8/iptables.8:1006 +#: original/man8/iptables-extensions.8:2379 msgid "" -"OS fingerprints are loadable using the B program. To load " -"fingerprints from a file, use:" +"N.B.: The DNAT target's B<--persistent> option replaced the SAME target." msgstr "" -#. type: Plain text -#: original/man8/iptables.8:1008 -msgid "B" -msgstr "" +#. type: TP +#: original/man8/iptables-extensions.8:2379 +#, fuzzy, no-wrap +#| msgid "B<--to-source >I[-I][:I-I]" +msgid "B<--to> I[B<->I]" +msgstr "B<--to-source >I[-I][:I-I]" #. type: Plain text -#: original/man8/iptables.8:1010 -msgid "To remove them again," +#: original/man8/iptables-extensions.8:2383 +msgid "" +"Addresses to map source to. May be specified more than once for multiple " +"ranges." msgstr "" +#. type: TP +#: original/man8/iptables-extensions.8:2383 +#, fuzzy, no-wrap +#| msgid "B<--tos >I" +msgid "B<--nodst>" +msgstr "B<--tos >I" + #. type: Plain text -#: original/man8/iptables.8:1012 -msgid "B" +#: original/man8/iptables-extensions.8:2387 +msgid "" +"Don't use the destination-ip in the calculations when selecting the new " +"source-ip" msgstr "" #. type: Plain text -#: original/man8/iptables.8:1015 +#: original/man8/iptables-extensions.8:2391 msgid "" -"The fingerprint database can be downlaoded from http://www.openbsd.org/cgi-" -"bin/cvsweb/src/etc/pf.os ." +"Port mapping will be forcibly randomized to avoid attacks based on port " +"prediction (kernel E= 2.6.21)." msgstr "" #. type: SS -#: original/man8/iptables.8:1241 -#, no-wrap -msgid "realm" -msgstr "" +#: original/man8/iptables-extensions.8:2391 +#, fuzzy, no-wrap +#| msgid "MARK" +msgid "SECMARK" +msgstr "MARK" #. type: Plain text -#: original/man8/iptables.8:1244 +#: original/man8/iptables-extensions.8:2400 msgid "" -"This matches the routing realm. Routing realms are used in complex routing " -"setups involving dynamic routing protocols like BGP." +"This is used to set the security mark value associated with the packet for " +"use by security subsystems such as SELinux. It is valid in the B " +"table (for backwards compatibility with older kernels, it is also valid in " +"the B table). The mark is 32 bits wide." msgstr "" #. type: TP -#: original/man8/iptables.8:1244 -#, fuzzy, no-wrap -#| msgid "B<--mark >I[/I]" -msgid "[B] B<--realm> I[BI]" -msgstr "B<--mark >I[/I]" - -#. type: Plain text -#: original/man8/iptables.8:1249 -msgid "" -"Matches a given realm number (and optionally mask). If not a number, value " -"can be a named realm from /etc/iproute2/rt_realms (mask can not be used in " -"that case)." +#: original/man8/iptables-extensions.8:2400 +#, no-wrap +msgid "B<--selctx> I" msgstr "" #. type: SS -#: original/man8/iptables.8:1680 +#: original/man8/iptables-extensions.8:2402 #, no-wrap -msgid "ttl" -msgstr "ttl" - -#. type: Plain text -#: original/man8/iptables.8:1682 -msgid "This module matches the time to live field in the IP header." -msgstr "このモジュールは IP ヘッダーの time to live フィールドにマッチする。" - -#. type: TP -#: original/man8/iptables.8:1682 -#, fuzzy, no-wrap -#| msgid "B<--ttl >I" -msgid "[B] B<--ttl-eq> I" -msgstr "B<--ttl >I" +msgid "SET" +msgstr "" #. type: Plain text -#: original/man8/iptables.8:1685 -msgid "Matches the given TTL value." -msgstr "指定された TTL 値にマッチする。" +#: original/man8/iptables-extensions.8:2405 +#, fuzzy +#| msgid "This module matches the SPIs in AH header of IPSec packets." +msgid "" +"This module adds and/or deletes entries from IP sets which can be defined by " +"ipset(8)." +msgstr "このモジュールは IPSec パケットの AH ヘッダーの SPI 値にマッチする。" #. type: TP -#: original/man8/iptables.8:1685 -#, fuzzy, no-wrap -#| msgid "B<--ttl >I" -msgid "B<--ttl-gt> I" -msgstr "B<--ttl >I" +#: original/man8/iptables-extensions.8:2405 +#, no-wrap +msgid "B<--add-set> I I[B<,>I...]" +msgstr "" #. type: Plain text -#: original/man8/iptables.8:1688 -#, fuzzy -#| msgid "Matches the given TTL value." -msgid "Matches if TTL is greater than the given TTL value." -msgstr "指定された TTL 値にマッチする。" +#: original/man8/iptables-extensions.8:2408 +msgid "add the address(es)/port(s) of the packet to the set" +msgstr "" #. type: TP -#: original/man8/iptables.8:1688 -#, fuzzy, no-wrap -#| msgid "B<--ttl >I" -msgid "B<--ttl-lt> I" -msgstr "B<--ttl >I" - -#. type: Plain text -#: original/man8/iptables.8:1691 -#, fuzzy -#| msgid "Matches the given TTL value." -msgid "Matches if TTL is less than the given TTL value." -msgstr "指定された TTL 値にマッチする。" +#: original/man8/iptables-extensions.8:2408 +#, no-wrap +msgid "B<--del-set> I I[B<,>I...]" +msgstr "" -#. type: SS -#: original/man8/iptables.8:1836 -#, no-wrap -msgid "unclean" -msgstr "unclean" +#. type: Plain text +#: original/man8/iptables-extensions.8:2411 +msgid "delete the address(es)/port(s) of the packet from the set" +msgstr "" #. type: Plain text -#: original/man8/iptables.8:1839 +#: original/man8/iptables-extensions.8:2417 msgid "" -"This module takes no options, but attempts to match packets which seem " -"malformed or unusual. This is regarded as experimental." +"where I(s) are B and/or B specifications and there can be no " +"more than six of them." msgstr "" -"このモジュールにはオプションがないが、 おかしく正常でないように見えるパケット" -"にマッチする。 これは実験的なものとして扱われている。" -#. @TARGET@ +#. type: TP +#: original/man8/iptables-extensions.8:2417 +#, fuzzy, no-wrap +#| msgid "B<--set-mss >I" +msgid "B<--timeout> I" +msgstr "B<--set-mss >I" + #. type: Plain text -#: original/man8/iptables.8:1843 +#: original/man8/iptables-extensions.8:2421 msgid "" -"iptables can use extended target modules: the following are included in the " -"standard distribution." +"when adding an entry, the timeout value to use instead of the default one " +"from the set definition" msgstr "" -"iptables は拡張ターゲットモジュールを使うことができる: 以下のものが、標準的な" -"ディストリビューションに含まれている。" -#. type: SS -#: original/man8/iptables.8:1873 -#, no-wrap -msgid "CLUSTERIP" +#. type: TP +#: original/man8/iptables-extensions.8:2421 +#, fuzzy, no-wrap +#| msgid "B<-x, --exact>" +msgid "B<--exist>" +msgstr "B<-x, --exact>" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2425 +msgid "" +"when adding an entry if it already exists, reset the timeout value to the " +"specified one or to the default from the set definition" msgstr "" #. type: Plain text -#: original/man8/iptables.8:1878 +#: original/man8/iptables-extensions.8:2428 msgid "" -"This module allows you to configure a simple cluster of nodes that share a " -"certain IP and MAC address without an explicit load balancer in front of " -"them. Connections are statically distributed between the nodes in this " -"cluster." +"Use of -j SET requires that ipset kernel support is provided, which, for " +"standard kernels, is the case since Linux 2.6.39." msgstr "" -#. type: TP -#: original/man8/iptables.8:1878 +#. type: SS +#: original/man8/iptables-extensions.8:2428 #, no-wrap -msgid "B<--new>" +msgid "SNAT (IPv4-specific)" msgstr "" #. type: Plain text -#: original/man8/iptables.8:1882 +#: original/man8/iptables-extensions.8:2437 msgid "" -"Create a new ClusterIP. You always have to set this on the first rule for a " -"given ClusterIP." +"This target is only valid in the B table, in the B chain. " +"It specifies that the source address of the packet should be modified (and " +"all future packets in this connection will also be mangled), and rules " +"should cease being examined. It takes one type of option:" msgstr "" +"このターゲットは B テーブルの B チェインのみで有効である。 " +"このターゲットはパケットの送信元アドレスを修正させる (この接続の以降のパケッ" +"トも修正して分からなく (mangle) する)。 さらに、ルールが評価を中止するように" +"指示する。 このターゲットにはオプションが 1 種類ある:" #. type: TP -#: original/man8/iptables.8:1882 +#: original/man8/iptables-extensions.8:2437 #, fuzzy, no-wrap -#| msgid "B<--cmd-owner >I" -msgid "B<--hashmode> I" -msgstr "B<--cmd-owner >I" +#| msgid "B<--to-source >I[-I][:I-I]" +msgid "B<--to-source> [I[B<->I]][B<:>I[B<->I]]" +msgstr "B<--to-source >I[-I][:I-I]" #. type: Plain text -#: original/man8/iptables.8:1886 +#: original/man8/iptables-extensions.8:2449 msgid "" -"Specify the hashing mode. Has to be one of B, B, B." +"which can specify a single new source IP address, an inclusive range of IP " +"addresses, and optionally, a port range (which is only valid if the rule " +"also specifies B<-p tcp> or B<-p udp>). If no port range is specified, then " +"source ports below 512 will be mapped to other ports below 512: those " +"between 512 and 1023 inclusive will be mapped to ports below 1024, and other " +"ports will be mapped to 1024 or above. Where possible, no port alteration " +"will occur." msgstr "" +"1 つの新しい送信元 IP アドレス、または IP アドレスの範囲が指定できる。 ポート" +"の範囲を指定することもできる (ルールが B<-p tcp> または B<-p udp> を指定して" +"いる場合にのみ有効)。 ポートの範囲が指定されていない場合、 512 未満の送信元" +"ポートは、他の 512 未満のポートにマッピングされる。 512 〜 1023 までのポート" +"は、1024 未満のポートにマッピングされる。 それ以外のポートは、1024 以上のポー" +"トにマッピングされる。 可能であれば、ポートの変換は起こらない。" -#. type: TP -#: original/man8/iptables.8:1886 -#, fuzzy, no-wrap -#| msgid "B<--set-mark >I" -msgid "B<--clustermac> I" -msgstr "B<--set-mark >I" +#. type: Plain text +#: original/man8/iptables-extensions.8:2456 +#, fuzzy +#| msgid "" +#| "You can add several --to-source options. If you specify more than one " +#| "source address, either via an address range or multiple --to-source " +#| "options, a simple round-robin (one after another in cycle) takes place " +#| "between these adresses." +msgid "" +"In Kernels up to 2.6.10, you can add several --to-source options. For those " +"kernels, if you specify more than one source address, either via an address " +"range or multiple --to-source options, a simple round-robin (one after " +"another in cycle) takes place between these addresses. Later Kernels " +"(E= 2.6.11-rc1) don't have the ability to NAT to multiple ranges anymore." +msgstr "" +"複数の --to-source オプションを指定することができる。 アドレスの範囲によっ" +"て、 もしくは複数の --to-source オプションによって 2 つ以上の送信元アドレスを" +"指定した場合、 それらのアドレスを使った単純なラウンド・ロビン (順々に循環させ" +"る) がおこなわれる。" #. type: Plain text -#: original/man8/iptables.8:1889 +#: original/man8/iptables-extensions.8:2461 msgid "" -"Specify the ClusterIP MAC address. Has to be a link-layer multicast address" +"If option B<--random> is used then port mapping will be randomized (kernel " +"E= 2.6.21)." msgstr "" -#. type: TP -#: original/man8/iptables.8:1889 -#, fuzzy, no-wrap -#| msgid "B<-t>, B<--table> B" -msgid "B<--total-nodes> I" -msgstr "B<-t>, B<--table> B" +#. type: SS +#: original/man8/iptables-extensions.8:2466 +#, no-wrap +msgid "TCPMSS" +msgstr "TCPMSS" #. type: Plain text -#: original/man8/iptables.8:1892 -msgid "Number of total nodes within this cluster." +#: original/man8/iptables-extensions.8:2473 +#, fuzzy +#| msgid "" +#| "This target allows to alter the MSS value of TCP SYN packets, to control " +#| "the maximum size for that connection (usually limiting it to your " +#| "outgoing interface's MTU minus 40). Of course, it can only be used in " +#| "conjunction with B<-p tcp>." +msgid "" +"This target allows to alter the MSS value of TCP SYN packets, to control the " +"maximum size for that connection (usually limiting it to your outgoing " +"interface's MTU minus 40 for IPv4 or 60 for IPv6, respectively). Of course, " +"it can only be used in conjunction with B<-p tcp>." msgstr "" - -#. type: TP -#: original/man8/iptables.8:1892 -#, fuzzy, no-wrap -#| msgid "B<--cmd-owner >I" -msgid "B<--local-node> I" -msgstr "B<--cmd-owner >I" +"このターゲットを用いると、TCP の SYN パケットの MSS 値を書き換え、 そのコネク" +"ションの最大サイズ (通常は、送信インターフェースの MTU から 40 引いた値) を" +"制御できる。 もちろん B<-p tcp> と組み合わせてしか使えない。" #. type: Plain text -#: original/man8/iptables.8:1895 -msgid "Local node number within this cluster." +#: original/man8/iptables-extensions.8:2480 +#, fuzzy +#| msgid "" +#| "This target is used to overcome criminally braindead ISPs or servers " +#| "which block ICMP Fragmentation Needed packets. The symptoms of this " +#| "problem are that everything works fine from your Linux firewall/router, " +#| "but machines behind it can never exchange large packets:" +msgid "" +"This target is used to overcome criminally braindead ISPs or servers which " +"block \"ICMP Fragmentation Needed\" or \"ICMPv6 Packet Too Big\" packets. " +"The symptoms of this problem are that everything works fine from your Linux " +"firewall/router, but machines behind it can never exchange large packets:" msgstr "" +"このターゲットは犯罪的に頭のいかれた ISP や ICMP Fragmentation Needed パケッ" +"トをブロックしてしまうサーバーを 乗り越えるために使用する。 Linux ファイア" +"ウォール/ルーターでは何も問題がないのに、 そこにぶら下がるマシンでは以下のよ" +"うに大きなパケットを やりとりできないというのが、この問題の兆候である。" -#. type: TP -#: original/man8/iptables.8:1895 -#, fuzzy, no-wrap -#| msgid "B<--limit >I" -msgid "B<--hash-init> I" -msgstr "B<--limit >I" +#. type: IP +#: original/man8/iptables-extensions.8:2480 +#, no-wrap +msgid "1." +msgstr "" #. type: Plain text -#: original/man8/iptables.8:1898 -msgid "Specify the random seed used for hash initialization." +#: original/man8/iptables-extensions.8:2482 +msgid "Web browsers connect, then hang with no data received." +msgstr "ウェブ・ブラウザで接続が、何のデータも受け取らずにハングする" + +#. type: IP +#: original/man8/iptables-extensions.8:2482 +#, no-wrap +msgid "2." msgstr "" -#. type: SS -#: original/man8/iptables.8:1997 +#. type: Plain text +#: original/man8/iptables-extensions.8:2484 +msgid "Small mail works fine, but large emails hang." +msgstr "短いメールは問題ないが、長いメールがハングする" + +#. type: IP +#: original/man8/iptables-extensions.8:2484 #, no-wrap -msgid "DNAT" -msgstr "DNAT" +msgid "3." +msgstr "" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2486 +msgid "ssh works fine, but scp hangs after initial handshaking." +msgstr "ssh は問題ないが、scp は最初のハンドシェーク後にハングする" #. type: Plain text -#: original/man8/iptables.8:2009 +#: original/man8/iptables-extensions.8:2489 msgid "" -"This target is only valid in the B table, in the B and " -"B chains, and user-defined chains which are only called from those " -"chains. It specifies that the destination address of the packet should be " -"modified (and all future packets in this connection will also be mangled), " -"and rules should cease being examined. It takes one type of option:" +"Workaround: activate this option and add a rule to your firewall " +"configuration like:" msgstr "" -"このターゲットは B テーブルの B, B チェイン、これら" -"のチェインから呼び出される ユーザー定義チェインのみで有効である。 このター" -"ゲットはパケットの送信先アドレスを修正する (この接続の以降のパケットも修正し" -"て分からなく (mangle) する)。 さらに、ルールによるチェックを止めさせる。 この" -"ターゲットにはオプションが 1 種類ある:" +"回避方法: このオプションを有効にし、以下のようなルールを ファイアウォールの設" +"定に追加する。" + +#. type: Plain text +#: original/man8/iptables-extensions.8:2492 +#, fuzzy, no-wrap +#| msgid "" +#| " iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \\e\n" +#| " -j TCPMSS --clamp-mss-to-pmtu\n" +msgid "" +" iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN\n" +" -j TCPMSS --clamp-mss-to-pmtu\n" +msgstr "" +" iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \\e\n" +" -j TCPMSS --clamp-mss-to-pmtu\n" #. type: TP -#: original/man8/iptables.8:2009 +#: original/man8/iptables-extensions.8:2492 #, fuzzy, no-wrap -#| msgid "B<--to-destination >I[-I][:I-I]" -msgid "B<--to-destination> [I[B<->I]][B<:>I[B<->I]]" -msgstr "B<--to-destination >I[-I][:I-I]" +#| msgid "B<--set-mss >I" +msgid "B<--set-mss> I" +msgstr "B<--set-mss >I" #. type: Plain text -#: original/man8/iptables.8:2020 -#, fuzzy -#| msgid "" -#| "which can specify a single new destination IP address, an inclusive range " -#| "of IP addresses, and optionally, a port range (which is only valid if the " -#| "rule also specifies B<-p tcp> or B<-p udp>). If no port range is " -#| "specified, then the destination port will never be modified." +#: original/man8/iptables-extensions.8:2497 msgid "" -"which can specify a single new destination IP address, an inclusive range of " -"IP addresses, and optionally, a port range (which is only valid if the rule " -"also specifies B<-p tcp> or B<-p udp>). If no port range is specified, then " -"the destination port will never be modified. If no IP address is specified " -"then only the destination port will be modified." +"Explicitly sets MSS option to specified value. If the MSS of the packet is " +"already lower than I, it will B be increased (from Linux 2.6.25 " +"onwards) to avoid more problems with hosts relying on a proper MSS." msgstr "" -"1 つの新しい送信先 IP アドレス、または IP アドレスの範囲が指定できる。 ポート" -"の範囲を指定することもできる (これはルールで B<-p tcp> または B<-p udp> を指" -"定している場合にのみ有効)。 ポートの範囲が指定されていない場合、送信先ポート" -"は変更されない。" + +#. type: TP +#: original/man8/iptables-extensions.8:2497 +#, no-wrap +msgid "B<--clamp-mss-to-pmtu>" +msgstr "B<--clamp-mss-to-pmtu>" #. type: Plain text -#: original/man8/iptables.8:2027 -#, fuzzy -#| msgid "" -#| "You can add several --to-destination options. If you specify more than " -#| "one destination address, either via an address range or multiple --to-" -#| "destination options, a simple round-robin (one after another in cycle) " -#| "load balancing takes place between these adresses." +#: original/man8/iptables-extensions.8:2506 msgid "" -"In Kernels up to 2.6.10 you can add several --to-destination options. For " -"those kernels, if you specify more than one destination address, either via " -"an address range or multiple --to-destination options, a simple round-robin " -"(one after another in cycle) load balancing takes place between these " -"addresses. Later Kernels (E= 2.6.11-rc1) don't have the ability to NAT " -"to multiple ranges anymore." +"Automatically clamp MSS value to (path_MTU - 40 for IPv4; -60 for IPv6). " +"This may not function as desired where asymmetric routes with differing path " +"MTU exist \\(em the kernel uses the path MTU which it would use to send " +"packets from itself to the source and destination IP addresses. Prior to " +"Linux 2.6.25, only the path MTU to the destination IP address was considered " +"by this option; subsequent kernels also consider the path MTU to the source " +"IP address." msgstr "" -"複数の --to-destination オプションを指定することができる。 アドレスの範囲に" -"よって、 もしくは複数の --to-destination オプションによって 2 つ以上の送信先" -"アドレスを指定した場合、 それらのアドレスを使った単純なラウンド・ロビン (順々" -"に循環させる) がおこなわれる。" -#. type: TP -#: original/man8/iptables.8:2027 original/man8/iptables.8:2159 -#: original/man8/iptables.8:2284 original/man8/iptables.8:2338 -#: original/man8/iptables.8:2407 +#. type: Plain text +#: original/man8/iptables-extensions.8:2508 +msgid "These options are mutually exclusive." +msgstr "これらのオプションはどちらか 1 つしか指定できない。" + +#. type: SS +#: original/man8/iptables-extensions.8:2508 #, no-wrap -msgid "B<--random>" +msgid "TCPOPTSTRIP" msgstr "" #. type: Plain text -#: original/man8/iptables.8:2032 original/man8/iptables.8:2289 +#: original/man8/iptables-extensions.8:2511 msgid "" -"If option B<--random> is used then port mapping will be randomized (kernel " -"E= 2.6.22)." +"This target will strip TCP options off a TCP packet. (It will actually " +"replace them by NO-OPs.) As such, you will need to add the B<-p tcp> " +"parameters." msgstr "" #. type: TP -#: original/man8/iptables.8:2032 original/man8/iptables.8:2412 +#: original/man8/iptables-extensions.8:2511 #, fuzzy, no-wrap -#| msgid "B<--helper >I" -msgid "B<--persistent>" -msgstr "B<--helper >I" +#| msgid "B<--destination-ports >I[,I[,I...]]" +msgid "B<--strip-options> I
" #~ msgstr "B<-t, --table >I
" -#~ msgid "B<-I, --insert>" -#~ msgstr "B<-I, --insert>" - #~ msgid "" #~ "List all rules in the selected chain. If no chain is selected, all " #~ "chains are listed. As every other iptables command, it applies to the " @@ -9814,9 +10550,6 @@ msgstr "B(8), B(8)" #~ msgstr "" #~ "引き数は、マッチを行う標準的な名前でも数値でもよい (名前のリストを見るには" -#~ msgid " iptables -m tos -h\n" -#~ msgstr " iptables -m tos -h\n" - #~ msgid "to see the list), or a numeric value to match." #~ msgstr "を使うこと)。" diff --git a/po4a/lib/iptables-lib.pot b/po4a/lib/iptables-lib.pot index 2842656..736b158 100644 --- a/po4a/lib/iptables-lib.pot +++ b/po4a/lib/iptables-lib.pot @@ -7,7 +7,7 @@ msgid "" msgstr "" "Project-Id-Version: PACKAGE VERSION\n" -"POT-Creation-Date: 2012-05-10 06:23+0900\n" +"POT-Creation-Date: 2013-04-03 12:25+0900\n" "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" "Last-Translator: FULL NAME \n" "Language-Team: LANGUAGE \n" -- 2.11.0