pve-firewall-rules-opts.adoc

   1 `--dest` `<string>` ::
   2
   3 Restrict packet destination address. This can refer to a single IP address, an
   4 IP set ('+ipsetname') or an IP alias definition. You can also specify an
   5 address range like '20.34.101.207-201.3.9.99', or a list of IP addresses and
   6 networks (entries are separated by comma). Please do not mix IPv4 and IPv6
   7 addresses inside such lists.
   8
   9 `--dport` `<string>` ::
  10
  11 Restrict TCP/UDP destination port. You can use service names or simple numbers
  12 (0-65535), as defined in '/etc/services'. Port ranges can be specified with
  13 '\d+:\d+', for example '80:85', and you can use comma separated list to match
  14 several ports or ranges.
  15
  16 `--icmp-type` `<string>` ::
  17
  18 Restrict ICMP packets to specific types. You can either use the names as
  19 ip[6]tables ('ip[6]tables -p icmp[v6] -h') provides them, or use the
  20 Type[/Code] value, for example 'network-unreachable' which corresponds to
  21 '3/0'.
  22
  23 `--iface` `<string>` ::
  24
  25 Network interface name. You have to use network configuration key names for VMs
  26 and containers ('net\d+'). Host related rules can use arbitrary strings.
  27
  28 `--log` `<alert | crit | debug | emerg | err | info | nolog | notice | warning>` ::
  29
  30 Log level for firewall rule.
  31
  32 `--proto` `<string>` ::
  33
  34 IP protocol. You can use protocol names ('tcp'/'udp') or simple numbers, as
  35 defined in '/etc/protocols'.
  36
  37 `--source` `<string>` ::
  38
  39 Restrict packet source address. This can refer to a single IP address, an IP
  40 set ('+ipsetname') or an IP alias definition. You can also specify an address
  41 range like '20.34.101.207-201.3.9.99', or a list of IP addresses and networks
  42 (entries are separated by comma). Please do not mix IPv4 and IPv6 addresses
  43 inside such lists.
  44
  45 `--sport` `<string>` ::
  46
  47 Restrict TCP/UDP source port. You can use service names or simple numbers
  48 (0-65535), as defined in '/etc/services'. Port ranges can be specified with
  49 '\d+:\d+', for example '80:85', and you can use comma separated list to match
  50 several ports or ranges.
  51