The -N chain option creates a new chain. The -X chain deletes an empty and unused chain. The -A chain rule adds a rule at the end of the given chain. The -I chain rule_num rule option inserts a rule before the rule number rule_num. The -D chain rule_num (or -D chain rule) option deletes a rule in a chain; the first syntax identifies the rule to be deleted by its number, while the latter identifies it by its contents. The -F chain option flushes a chain (deletes all its rules); if no chain is mentioned, all the rules in the table are deleted. The -L chain option lists the rules in the chain. Finally, the -P chain action option defines the default action, or “policy”, for a given chain; note that only standard chains can have such a policy.

Each rule is expressed as conditions -j action action_options. If several conditions are described in the same rule, then the criterion is the conjunction (logical and) of the conditions, which is at least as restrictive as each individual condition.

-p protocol 条件匹配 IP 数据包的协议区段。最常见的是 tcp，udp，icmp，和 icmpv6。条件之前加上感叹号表示求反，就变成了“除了指定协议之外的任何数据包”。这种求反机制不仅仅适用于 -p 选项，也可用于其它所有条件。

-s address 或 -s network/mask 条件匹配数据包的源地址。相应地，-d address 或 -d network/mask 匹配目的地地址。

-i interface 条件选择源自指定网络接口的数据包。-o interface 条件选择从指定接口出去的数据包。

根据上述的通用条件，可以定义更具体的条件。例如，-p tcp 条件可以和 TCP 端口条件互为补充，就形成例如--source-port port 和 --destination-port port。

--state state 条件匹配连接中某个状态的数据包（这需要 ipt_conntrack 内核模块，用于连接追踪）。新（NEW） 状态指明开启新连接的数据包；建立（ESTABLISHED） 匹配属于已存在连接的数据包；相关（RELATED） 匹配发起与已存在连接相关的数据包（这对处于“活动”模式的 ftp-data 连接是很有用的）。

前面的段落列出了可用的操作，但是没有相应的选项。例如：记录 LOG 操作，有如下的选项：

The DNAT action provides the --to-destination address:port option to indicate the new destination IP address and/or port. Similarly, SNAT provides --to-source address:port to indicate the new source IP address and/or port.

The REDIRECT action (only available if NAT is available) provides the --to-ports port(s) option to indicate the port, or port range, where the packets should be redirected.