libxt_policy.man revision 15392934cf81ef85e2a1c21380c61a7a42e260d5 
15d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)This modules matches the policy used by IPsec for handling a packet.
25d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles).TP
35d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)\fB\-\-dir\fP {\fBin\fP|\fBout\fP}
45d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)Used to select whether to match the policy used for decapsulation or the
55d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)policy that will be used for encapsulation.
65d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles).B in
75d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)is valid in the
85d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles).B PREROUTING, INPUT and FORWARD
95d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)chains,
105d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles).B out
115d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)is valid in the
125d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles).B POSTROUTING, OUTPUT and FORWARD
135d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)chains.
145d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles).TP
155d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)\fB\-\-pol\fP {\fBnone\fP|\fBipsec\fP}
165d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)Matches if the packet is subject to IPsec processing. \fB\-\-pol none\fP
175d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)cannot be combined with \fB\-\-strict\fP.
185d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles).TP
195d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)\fB\-\-strict\fP
205d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)Selects whether to match the exact policy or match if any rule of
215d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)the policy matches the given policy.
225d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles).PP
235d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)For each policy element that is to be described, one can use one or more of
245d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)the following options. When \fB\-\-strict\fP is in effect, at least one must be
255d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)used per element.
265d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles).TP
275d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)[\fB!\fP] \fB\-\-reqid\fP \fIid\fP
285d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)Matches the reqid of the policy rule. The reqid can be specified with
295d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles).B setkey(8)
305d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)using
315d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles).B unique:id
325d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)as level.
335d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles).TP
345d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)[\fB!\fP] \fB\-\-spi\fP \fIspi\fP
355d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)Matches the SPI of the SA.
365d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles).TP
375d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)[\fB!\fP] \fB\-\-proto\fP {\fBah\fP|\fBesp\fP|\fBipcomp\fP}
385d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)Matches the encapsulation protocol.
39.TP
40[\fB!\fP] \fB\-\-mode\fP {\fBtunnel\fP|\fBtransport\fP}
41Matches the encapsulation mode.
42.TP
43[\fB!\fP] \fB\-\-tunnel\-src\fP \fIaddr\fP[\fB/\fP\fImask\fP]
44Matches the source end-point address of a tunnel mode SA.
45Only valid with \fB\-\-mode tunnel\fP.
46.TP
47[\fB!\fP] \fB\-\-tunnel\-dst\fP \fIaddr\fP[\fB/\fP\fImask\fP]
48Matches the destination end-point address of a tunnel mode SA.
49Only valid with \fB\-\-mode tunnel\fP.
50.TP
51\fB\-\-next\fP
52Start the next element in the policy specification. Can only be used with
53\fB\-\-strict\fP.
54