ARPTABLES(8)

🎀 ARPTABLES(8) 🎀 ARP table administration (nft-based) 💖

✨ NAME ✨

okay so arptables is the ARPTABLES(8) tool, and it's all about ARP table administration (nft-based) 🦋

💅 SYNOPSIS 💅

arptables [-t table] {-A|-D} chain rule-specification [options...]

arptables [-t table] -I chain [rulenum] rule-specification

arptables [-t table] -R chain rulenum rule-specification

arptables [-t table] -D chain rulenum

arptables [-t table] {-F|-L|-Z} [chain [rulenum]] [options...]

arptables [-t table] -N chain

arptables [-t table] -X [chain]

arptables [-t table] -P chain policy

arptables [-t table] -E old-chain-name new-chain-name

rule-specification := [matches...] [target]

match := -m matchname [per-match-options]

target := -j targetname [per-target-options]

📖 DESCRIPTION 📖

bestie, arptables is a user space tool 🧚 It's how you set up and maintain the tables of ARP rules in the Linux kernel, and those rules inspect the ARP frames they see. It's giving iptables energy, but arptables is less complicated 🌸

🦋 CHAINS 🦋

So the table is used to divide functionality into different sets of rules, and each set is called a chain 🍓 A chain is an ordered list of rules that can match ARP frames. If a rule matches a frame, a processing specification tells what to do with it, and that spec is called a 'target' 🎯 But if the frame doesn't match the current rule, the next rule in the chain gets checked, and so on and so forth. You can also create your own (user-defined) chains and use them as the 'target' of a rule. Iconic 👑

🎯 TARGETS 🎯

A firewall rule has criteria for an ARP frame plus a frame processing specification called a target. When a frame matches, the kernel's next move is decided by the target. The target can be one of these values: ACCEPT, DROP, CONTINUE, RETURN, an 'extension' (see below) or a user-defined chain 💜

• ACCEPT — means let the frame through ✨
• DROP — means the frame has to be dropped 💀
• CONTINUE — means the next rule has to be checked. This is handy for knowing how many frames pass a certain point in the chain, or for logging those frames 📊
• RETURN — means stop traversing this chain and resume at the next rule in the previous (calling) chain 🔁

For the extension targets, check the TARGET EXTENSIONS section of this man page, it's all there 🫶

🗂️ TABLES 🗂️

Real talk, there's only one ARP table in the Linux kernel, and it's filter. You can drop the -t filter argument to the arptables command. If you do use -t, it has to be the first argument on the arptables command line 🌈

• -t, --table — filter is the only table, and it contains two built-in chains: INPUT (for frames destined for the host) and OUTPUT (for locally-generated frames) 🏠

🎀 ARPTABLES COMMAND LINE ARGUMENTS 🎀

After the initial arptables command line argument, the rest of your arguments sort into a few groups: commands, miscellaneous commands, rule-specifications, match-extensions, and watcher-extensions 🧁

👑 COMMANDS 👑

These are the actions you perform on the table you picked with -t. If you don't use -t, the commands hit the default filter table. With the exception of the -Z command, you can only use one command on the command line at a time, so no multitasking 🙈

• -A, --append — tacks a rule onto the very end of the selected chain 📌
• -D, --delete — deletes a rule from the selected chain. There are two ways to do this. The first is by giving an interval of rule numbers, syntax: start_nr[:end_nr]. Negative numbers are allowed too, and for more on those, check the -I command. The second is by typing out the complete rule exactly as it was when you added it 🗑️
• -I, --insert — inserts the rule into the selected chain at the rule number you give. If the chain currently has N rules, the number can be anywhere between -N and N+1. For a positive number i, i and i-N-1 point to the same spot in the chain. The number 0 means the spot past the last rule, which makes it the same as using -A 🧩
• -R, --replace — replaces the rule at the given rule number in the selected chain. If the chain has N rules, the number can be between 1 and N. i is the spot in the chain where the replacement happens 🔄
• -P, --policy — sets the policy for the chain to the target you give. The policy can be ACCEPT, DROP or RETURN 📜
• -F, --flush — flushes the selected chain. If you don't select one, every chain gets flushed 🌊 Flushing doesn't change the chain's policy though, so don't panic 🫧
• -Z, --zero — resets the counters of the selected chain to zero. If no chain is selected, all the counters go to zero ⏲️ You can pair -Z with -L, and when you do that, the rule counters get printed on screen before they're zeroed, so you still get to see the tea ☕
• -L, --list — lists all rules in the selected chain. If no chain is selected, every chain gets listed 📋
• -N, --new-chain — creates a new user-defined chain with the name you give. There's no limit on how many user-defined chains you can make, and a user-defined chain name can be at most 31 characters 🌟
• -X, --delete-chain — deletes the specified user-defined chain. There must be no remaining references to it, or arptables will refuse to delete it 🙅‍♀️ If you don't specify a chain, all user-defined chains that aren't referenced get removed 🧹
• -E, --rename-chain — renames the specified chain to a new name 💫 Besides renaming a user-defined chain, you can also rename a standard chain name to whatever suits your taste. For example, if you like PREBRIDGING more than PREROUTING, you can use -E to rename the PREROUTING chain. Heads up though: if you rename one of the standard arptables chain names and then post a question on the arptables mailing lists, please mention that fact. It's wise to use the standard name in your post. Renaming a standard arptables chain this way has no effect on the structure or function of the arptables kernel table 🫶

🌸 MISCELLANEOUS COMMANDS 🌸

• -V, --version — shows the version of the arptables userspace program 🏷️
• -h, --help — gives you a brief description of the command syntax 🆘
• -j, --jump target — the target of the rule. It's one of these values: ACCEPT, DROP, CONTINUE, RETURN, a target extension (see TARGET EXTENSIONS), or a user-defined chain name 🎯
• -c, --set-counters PKTS BYTES — lets you initialize the packet and byte counters of a rule during INSERT, APPEND, or REPLACE operations 🔢

🧚 RULE-SPECIFICATIONS 🧚

These command line arguments make up a rule specification (the stuff used in the add and delete commands). A "!" option placed before the specification inverts the test for that specification 🙃 Apart from these standard rule specifications, there are some other command line arguments worth knowing about 💜

• -s, --source-ip [!] address[/mask] — the Source IP specification 📍
• -d, --destination-ip [!] address[/mask] — the Destination IP specification 🎯
• --source-mac [!] address[/mask] — the source MAC address. Both mask and address are written as 6 hexadecimal numbers separated by colons 🔐
• --destination-mac [!] address[/mask] — the destination MAC address. Both mask and address are written as 6 hexadecimal numbers separated by colons 🔐
• -i, --in-interface [!] name — the interface a frame is received on (for the INPUT chain). The flag --in-if is an alias for this option 📥
• -o, --out-interface [!] name — the interface a frame is going to be sent out of (for the OUTPUT chain). The flag --out-if is an alias for this option 📤
• -l, --h-length length[/mask] — the hardware length, in number of bytes 📏
• --opcode code[/mask] — the operation code (2 bytes). Available values are: 1=Request, 2=Reply, 3=Request_Reverse, 4=Reply_Reverse, 5=DRARP_Request, 6=DRARP_Reply, 7=DRARP_Error, 8=InARP_Request, 9=ARP_NAK 🧾
• --h-type type[/mask] — the hardware type (2 bytes, hexadecimal). Available values are: 1=Ethernet 🔌
• --proto-type type[/mask] — the protocol type (2 bytes). Available values are: 0x800=IPv4 🌐

🔥 TARGET-EXTENSIONS 🔥

arptables extensions are precompiled into the userspace tool, so there's no need to load them with a -m option like you would in iptables 🙌 That said, these extensions deal with functionality supported by supplemental kernel modules, so they're not nothing 🧠

🦋 mangle 🦋

• --mangle-ip-s IP address — mangles the Source IP Address to the given value 🪄
• --mangle-ip-d IP address — mangles the Destination IP Address to the given value 🪄
• --mangle-mac-s MAC address — mangles the Source MAC Address to the given value 🪄
• --mangle-mac-d MAC address — mangles the Destination MAC Address to the given value 🪄
• --mangle-target target — the target of the ARP mangle operation (DROP, CONTINUE or ACCEPT — default is ACCEPT) 🎯

🌈 CLASSIFY 🌈

This module lets you set the skb->priority value, which means you can classify the packet into a specific CBQ class 🏷️

• --set-class major:minor — sets the major and minor class value. The values are always interpreted as hexadecimal, even if you don't give a 0x prefix 🔢

💜 MARK 💜

This module lets you set the skb->mark value, so you can classify the packet by the mark in u32 🔖

• --set-mark mark — sets the mark value. The values are always interpreted as hexadecimal, even if you don't give a 0x prefix 🔖
• --and-mark mark — does a binary AND of the mark with bits 🧮
• --or-mark mark — does a binary OR of the mark with bits 🧮

🍓 NOTES 🍓

⚠️ Heads up, bestie: in this nft-based version of arptables, support for the FORWARD chain has not been implemented 😭 ARP packets only get "forwarded" by Linux bridges, so you can get the same effect using the FORWARD chain in ebtables instead 🫶

📬 MAILINGLISTS 📬

Check out http://netfilter.org/mailinglists.html 💌

🦋 SEE ALSO 🦋

xtables-nft(8), iptables(8), ebtables(8), ip(8) ✨ Also see https://wiki.nftables.org for more tea 🍵

---

Okay that's the whole ARPTABLES(8) tea, bestie 💖 Dated March 2019 and filed under ARPTABLES(8) 🎀 Stay iconic, go touch some grass, and I'll see you in the group chat 🌸🫶💅