ARGH iptables.

http://wiki.centos.org/HowTos/Network/IPTables


-A, --append chain rule-specification
              Append one or more rules to the end of the selected chain.  When the source and/or destination names resolve to more  than  one  address,  a
              rule will be added for each possible address combination.

  -p, --protocol [!] protocol
              The  protocol  of  the  rule or of the packet to check.  The specified protocol can be one of tcp, udp, icmp, or all, or it can be a numeric
              value, representing one of these protocols or a different one.  A protocol name from /etc/protocols is also allowed.  A "!" argument  before
              the  protocol  inverts  the test.  The number zero is equivalent to all.  Protocol all will match with all protocols and is taken as default
              when this option is omitted.


-j, --jump target
              This specifies the target of the rule; i.e., what to do if the packet matches it.  The target can be a user-defined chain  (other  than  the
              one  this  rule  is in), one of the special builtin targets which decide the fate of the packet immediately, or an extension (see EXTENSIONS
              below).  If this option is omitted in a rule (and -g is not used), then matching the rule will have no effect on the packet’s fate, but  the
              counters on the rule will be incremented.

-i, --in-interface [!] name
              Name of an interface via which a packet was received (only for packets entering the INPUT, FORWARD and PREROUTING  chains).   When  the  "!"
              argument  is  used  before  the interface name, the sense is inverted.  If the interface name ends in a "+", then any interface which begins
              with this name will match.  If this option is omitted, any interface name will match.

       -o, --out-interface [!] name
              Name of an interface via which a packet is going to be sent (for packets entering the FORWARD, OUTPUT and POSTROUTING chains).  When the "!"
              argument  is  used  before  the interface name, the sense is inverted.  If the interface name ends in a "+", then any interface which begins
              with this name will match.  If this option is omitted, any interface name will match.


MATCH EXTENSIONS
       iptables can use extended packet matching modules.  These are loaded in two ways: implicitly, when -p or --protocol is specified, or with the -m or
       --match options, followed by the matching module name; after these, various extra command line options become available, depending on the  specific
       module.   You can specify multiple extended match modules in one line, and you can use the -h or --help options after the module has been specified
       to receive help specific to that module.