[ <short>short description</short> ] [ <description>description</description> ] [ <service name="string"/> ] [ <port port="portid[-portid]" protocol="`tcp`|`udp`|`sctp`|`dccp`"/> ] [ <protocol value="protocol"/> ] [ <icmp-block name="string"/> ] [ <masquerade/> ] [ <forward-port port="portid[-portid]" protocol="`tcp`|`udp`|`sctp`|`dccp`" [to-port="portid[-portid]"] [to-addr="IP address"]/> ] [ <source-port port="portid[-portid]" protocol="`tcp`|`udp`|`sctp`|`dccp`"/> ] [ <rule [family="`ipv4`|`ipv6`"] [priority="priority"]> [ <source address="address[/mask]"|mac="MAC"|ipset="ipset" [invert="True"]/> ] [ <destination address="address[/mask]"|ipset="ipset" [invert="True"]/> ] [ <service name="string"/> | <port port="portid[-portid]" protocol="`tcp`|`udp`|`sctp`|`dccp`"/> | <protocol value="protocol"/> | <icmp-block name="icmptype"/> | <icmp-type name="icmptype"/> | <masquerade/> | <forward-port port="portid[-portid]" protocol="`tcp`|`udp`|`sctp`|`dccp`" [to-port="portid[-portid]"] [to-addr="address"]/> ] [ <log [prefix="prefix text"] [level="`emerg`|`alert`|`crit`|`err`|`warn`|`notice`|`info`|`debug`"]> [<limit value="rate/duration"/>] </log> | <nflog [group="group id"] [prefix="prefix text"] [queue-size="threshold"]> [<limit value="rate/duration"/>] </nflog> ] [ <audit> [<limit value="rate/duration"/>] </audit> ] [ <accept> [<limit value="rate/duration"/>] </accept> | <reject [type="rejecttype"]> [<limit value="rate/duration"/>] </reject> | <drop> [<limit value="rate/duration"/>] </drop> | <mark set="mark[/mask]"> [<limit value="rate/duration"/>] </mark> ] </rule> ]