Iptables Tutorial 1.2.2

Table 10-9. ESP match options

Match--espspiKernel2.5 and 2.6Exampleiptables -A INPUT -p 50 -m esp --espspi 500ExplanationThe ESP counterpart Security Parameter Index (SPI) is used exactly the same way as the AH variant. The match looks exactly the same, with the esp/ah difference. Of course, this match can match a whole range of SPI numbers as well as the AH variant of the SPI match, such as --espspi 200:250 which matches the whole range of SPI's.