Rules

Each chain can have one or more rules that define the following:

•	The packet characteristics being filtered

The packet is checked for characteristics defined in the rule, for example, a specific IP header, input and output interfaces, TCP flags and protocol.

•	What to do when the packet characteristics match the rule

When a packet is filtered, its characteristics are compared against the rules one-by-one. All defined characteristics must match.

Administrators can do the following to specify packet filtering:

•	Add a new chain and specify rules for that chain

•	Add new rules for existing chains

•	Edit or delete built-in chains and rules