arptables

arptables [OPTIONS] chain rule-specification

arptables manages ARP (Address Resolution Protocol) packet filtering rules. It is similar to iptables but operates at the ARP level, allowing control over which ARP requests and replies are accepted or dropped.

-L, --list

List all rules in selected chain or all chains

Append rule to the end of chain

Insert rule at the given position (default: top of chain)

Replace an existing rule by number

Delete matching rule or rule by number

Flush all rules

Zero packet and byte counters in a chain

Set default policy for a chain

Create a new user-defined chain

Delete a user-defined chain

Match source IP address

Match destination IP address

Match source MAC address

Match destination MAC address

Match the input interface (INPUT, FORWARD)

Match the output interface (OUTPUT, FORWARD)

Match the ARP opcode (e.g., Request, Reply)

Target for rule (ACCEPT, DROP, etc.)

Requires root privileges. Uses the nftables backend on modern systems. The nft-based arptables provides only the INPUT and OUTPUT chains; the FORWARD chain exists only in the legacy implementation. ARP filtering operates at the layer 2/3 boundary and may affect network connectivity if misconfigured. Use arptables-save and arptables-restore to persist and reload rule sets.

arptables is part of the xtables-nft suite, providing ARP packet filtering integrated with the netfilter framework.

iptables(8), nft(8), arp(8), ebtables(8)

Source code · Homepage · Documentation