# arptables-nft

## NAME



           arptables — ARP table administration (nft-based)
    


## SYNOPSIS



           **arptables**[**-t** _table_] {**-A|-D**} _chain rule-specification_ [options...]
    
           **arptables**[**-t** _table_] **-I** _chain_ [_rulenum_] _rule-specification_
    
           **arptables**[**-t** _table_] **-R** _chain rulenum rule-specification_
    
           **arptables**[**-t** _table_] **-D** _chain rulenum_
    
           **arptables**[**-t** _table_] {**-F** |**-L** |**-Z**} [_chain_ [_rulenum_]] [_options..._]
    
           **arptables**[**-t** _table_] **-N** _chain_
    
           **arptables**[**-t** _table_] **-X**[_chain_]
    
           **arptables**[**-t** _table_] **-P** _chain policy_
    
           **arptables**[**-t** _table_] **-E** _old-chain-name new-chain-name_
    
           rule-specification := [matches...] [target]
    
           match := **-m** _matchname_ [per-match-options]
    
           target := **-j** _targetname_ [per-target-options]
    


## DESCRIPTION



           **arptables** is a user space tool, it is used to set up and maintain
           the tables of ARP rules in the Linux kernel. These rules inspect
           the ARP frames which they see.  **arptables** is analogous to the
           **iptables** user space tool, but **arptables** is less complicated.
    
       **CHAINS**
           The kernel table is used to divide functionality into different
           sets of rules. Each set of rules is called a chain.  Each chain is
           an ordered list of rules that can match ARP frames. If a rule
           matches an ARP frame, then a processing specification tells what
           to do with that matching frame. The processing specification is
           called a 'target'. However, if the frame does not match the
           current rule in the chain, then the next rule in the chain is
           examined and so forth.  The user can create new (user-defined)
           chains which can be used as the 'target' of a rule.
    
       **TARGETS**
           A firewall rule specifies criteria for an ARP frame and a frame
           processing specification called a target.  When a frame matches a
           rule, then the next action performed by the kernel is specified by
           the target.  The target can be one of these values: _ACCEPT_ , _DROP_ ,
           _CONTINUE_ , _RETURN_ , an 'extension' (see below) or a user-defined
           chain.
    
           _ACCEPT_ means to let the frame through.  _DROP_ means the frame has
           to be dropped.  _CONTINUE_ means the next rule has to be checked.
           This can be handy to know how many frames pass a certain point in
           the chain or to log those frames.  _RETURN_ means stop traversing
           this chain and resume at the next rule in the previous (calling)
           chain.  For the extension targets please see the **TARGET EXTENSIONS**
           section of this man page.
    
       **TABLES**
           There is only one ARP table in the Linux kernel.  The table is
           **filter.** You can drop the '-t filter' argument to the arptables
           command.  The -t argument must be the first argument on the
           arptables command line, if used.
    
           **-t, --table**
                  **filter** , is the only table and contains two built-in chains:
                  **INPUT**(for frames destined for the host) and **OUTPUT**(for
                  locally-generated frames).
    


## ARPTABLES COMMAND LINE ARGUMENTS



           After the initial arptables command line argument, the remaining
           arguments can be divided into several different groups.  These
           groups are commands, miscellaneous commands, rule-specifications,
           match-extensions, and watcher-extensions.
    
       **COMMANDS**
           The arptables command arguments specify the actions to perform on
           the table defined with the -t argument. If you do not use the -t
           argument to name a table, the commands apply to the default filter
           table.  With the exception of the **-Z** command, only one command may
           be used on the command line at a time.
    
           **-A, --append**
                  Append a rule to the end of the selected chain.
    
           **-D, --delete**
                  Delete the specified rule from the selected chain. There
                  are two ways to use this command. The first is by
                  specifying an interval of rule numbers to delete, syntax:
                  start_nr[:end_nr]. Using negative numbers is allowed, for
                  more details about using negative numbers, see the -I
                  command. The second usage is by specifying the complete
                  rule as it would have been specified when it was added.
    
           **-I, --insert**
                  Insert the specified rule into the selected chain at the
                  specified rule number.  If the current number of rules
                  equals N, then the specified number can be between -N and
                  N+1. For a positive number i, it holds that i and i-N-1
                  specify the same place in the chain where the rule should
                  be inserted. The number 0 specifies the place past the last
                  rule in the chain and using this number is therefore
                  equivalent with using the -A command.
    
           **-R, --replace**
                  Replaces the specified rule into the selected chain at the
                  specified rule number.  If the current number of rules
                  equals N, then the specified number can be between 1 and N.
                  i specifies the place in the chain where the rule should be
                  replaced.
    
           **-P, --policy**
                  Set the policy for the chain to the given target. The
                  policy can be **ACCEPT** , **DROP** or **RETURN**.
    
           **-F, --flush**
                  Flush the selected chain. If no chain is selected, then
                  every chain will be flushed. Flushing the chain does not
                  change the policy of the chain, however.
    
           **-Z, --zero**
                  Set the counters of the selected chain to zero. If no chain
                  is selected, all the counters are set to zero. The **-Z**
                  command can be used in conjunction with the **-L** command.
                  When both the **-Z** and **-L** commands are used together in this
                  way, the rule counters are printed on the screen before
                  they are set to zero.
    
           **-L, --list**
                  List all rules in the selected chain. If no chain is
                  selected, all chains are listed.
    
           **-N, --new-chain**
                  Create a new user-defined chain with the given name. The
                  number of user-defined chains is unlimited. A user-defined
                  chain name has maximum length of 31 characters.
    
           **-X, --delete-chain**
                  Delete the specified user-defined chain. There must be no
                  remaining references to the specified chain, otherwise
                  **arptables** will refuse to delete it. If no chain is
                  specified, all user-defined chains that aren't referenced
                  will be removed.
    
           **-E, --rename-chain**
                  Rename the specified chain to a new name.  Besides renaming
                  a user-defined chain, you may rename a standard chain name
                  to a name that suits your taste. For example, if you like
                  PREBRIDGING more than PREROUTING, then you can use the -E
                  command to rename the PREROUTING chain. If you do rename
                  one of the standard **arptables** chain names, please be sure
                  to mention this fact should you post a question on the
                  **arptables** mailing lists.  It would be wise to use the
                  standard name in your post. Renaming a standard **arptables**
                  chain in this fashion has no effect on the structure or
                  function of the **arptables** kernel table.
    
       **MISCELLANEOUS COMMANDS**
           **-V, --version**
                  Show the version of the arptables userspace program.
    
           **-h, --help**
                  Give a brief description of the command syntax.
    
           **-j, --jump** _target_
                  The target of the rule. This is one of the following
                  values: **ACCEPT** , **DROP** , **CONTINUE** , **RETURN** , a target extension
                  (see **TARGET EXTENSIONS**) or a user-defined chain name.
    
           **-c, --set-counters** _PKTS BYTES_
                  This enables the administrator to initialize the packet and
                  byte counters of a rule (during **INSERT, APPEND, REPLACE**
                  operations).
    
           **--compat**
                  When creating a rule, attach compatibility data to the
                  rule's userdata section for use as aid in parsing the rule
                  by an older version of the program. The old version
                  obviously needs to support this, though.  Specifying this
                  option a second time instructs the program to default to
                  the rule's compatibility data when parsing, which is mostly
                  useful for debugging or testing purposes.
    
                  The **XTABLES_COMPAT** environment variable can be used to
                  override the default setting. The expected value is a
                  natural number representing the number of times **--compat**
                  was specified.
    
       **RULE-SPECIFICATIONS**
           The following command line arguments make up a rule specification
           (as used in the add and delete commands). A "!" option before the
           specification inverts the test for that specification. Apart from
           these standard rule specifications there are some other command
           line arguments of interest.
    
           **-s, --source-ip**[!] _address_[/_mask]_
                  The Source IP specification.
    
           **-d, --destination-ip**[!] _address_[/_mask]_
                  The Destination IP specification.
    
           **--source-mac**[!] _address_[/_mask_]
                  The source mac address. Both mask and address are written
                  as 6 hexadecimal numbers separated by colons.
    
           **--destination-mac**[!] _address_[/_mask_]
                  The destination mac address. Both mask and address are
                  written as 6 hexadecimal numbers separated by colons.
    
           **-i, --in-interface**[!] _name_
                  The interface via which a frame is received (for the **INPUT**
                  chain). The flag **--in-if** is an alias for this option.
    
           **-o, --out-interface**[!] _name_
                  The interface via which a frame is going to be sent (for
                  the **OUTPUT** chain). The flag **--out-if** is an alias for this
                  option.
    
           **-l, --h-length** _length_[/_mask_]
                  The hardware length (nr of bytes)
    
           **--opcode** _code_[/_mask_]
                  The operation code (2 bytes). Available values are:
                  **1** =**Request 2** =**Reply 3** =**Request_Reverse 4** =**Reply_Reverse**
                  **5** =**DRARP_Request 6** =**DRARP_Reply 7** =**DRARP_Error 8** =**InARP_Request**
                  **9** =**ARP_NAK**.
    
           **--h-type** _type_[/_mask_]
                  The hardware type (2 bytes, hexadecimal). Available values
                  are: **1** =**Ethernet**.
    
           **--proto-type** _type_[/_mask_]
                  The protocol type (2 bytes). Available values are:
                  **0x800** =**IPv4**.
    
       **TARGET-EXTENSIONS**
           **arptables** extensions are precompiled into the userspace tool. So
           there is no need to explicitly load them with a -m option like in
           **iptables**.  However, these extensions deal with functionality
           supported by supplemental kernel modules.
    
       **mangle**
           **--mangle-ip-s IP address**
                  Mangles Source IP Address to given value.
    
           **--mangle-ip-d IP address**
                  Mangles Destination IP Address to given value.
    
           **--mangle-mac-s MAC address**
                  Mangles Source MAC Address to given value.
    
           **--mangle-mac-d MAC address**
                  Mangles Destination MAC Address to given value.
    
           **--mangle-target target**
                  Target of ARP mangle operation (**DROP** , **CONTINUE** or **ACCEPT** —
                  default is **ACCEPT**).
    
       **CLASSIFY**
           This module allows you to set the skb->priority value (and thus
           classify the packet into a specific CBQ class).
    
           **--set-class major:minor**
    
                  Set the major and minor  class  value.  The  values  are
                  always interpreted as hexadecimal even if no 0x prefix is
                  given.
    
       **MARK**
           This  module  allows you to set the skb->mark value (and thus
           classify the packet by the mark in u32)
    
           **--set-mark mark**
                  Set the mark value. The  values  are  always interpreted as
                  hexadecimal even if no 0x prefix is given
    
           **--and-mark mark**
                  Binary AND the mark with bits.
    
           **--or-mark mark**
                  Binary OR the mark with bits.
    


## NOTES



           In this nft-based version of **arptables** , support for **FORWARD** chain
           has not been implemented. Since ARP packets are "forwarded" only
           by Linux bridges, the same may be achieved using **FORWARD** chain in
           **ebtables**.
    


## MAILINGLISTS



           See **http://netfilter.org/mailinglists.html **
    


* * *