Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have been learning and studying up on iptables and port forwarding. There is a sample iptables output I can't decipher. It has the options --dir, --pol, and -m. Although I am familiar with -m it wasn't followed by limit or a listed option. instead it is -m policy

I searched these options for iptables but wasn't able to find anything. Can you create your own options?

-A INPUT -s -d -i eth2 -m policy --dir in --pol ipsec --reqid 6 --proto esp -j ACCEPT

share|improve this question
Could you try listing this sample output, without knowing what it is you are doing it is difficult to tell what you are asking. – Mokubai Sep 18 '13 at 21:36
up vote 0 down vote accepted

Can you create your own options?

If by create, you mean write a Linux Kernel module, then yes. You can build all the modules and new options. There are also many non-standard netfilter modules for obscure or new protocols and filtering that haven't made it into the mainline kernel.

Modules occasionally get added to the kernel. So that policy module you mention seems to available on my 12.04 Ubuntu system and an older Debian system. But it isn't installed on an even older Debian system I have.

I searched these options for iptables but wasn't able to find anything.

It seems to be documented on by Ubuntu system in the iptables(8) man page. It also seems to be documented in the iptables man page. It many not be available on your system because of the age, or because your system was built differently.

Here is an excerpt from my man page.

policy This modules matches the policy used by IPsec for handling a packet.

   --dir {in|out}
          Used to select whether to match the policy used  for  decapsula‐
          tion  or  the policy that will be used for encapsulation.  in is
          valid in the PREROUTING, INPUT and FORWARD chains, out is  valid
          in the POSTROUTING, OUTPUT and FORWARD chains.

   --pol {none|ipsec}
          Matches if the packet is subject to IPsec processing. --pol none
          cannot be combined with --strict.


If you have the .config file used to build your kernel you can see if the option was set to build that as a module

# grep -i policy /boot/config-2.6.26-2-686 
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.