Sim, eles são para ambas as perguntas.
ALL
é o mesmo que FIN,SYN,RST,PSH,ACK,URG
.
Confira o comando man iptables-extensions
em --tcp-flags
, que é usado quando o protocolo TCP é usado: -p tcp
.
[!] --tcp-flags mask comp
Match when the TCP flags are as specified. The first argument
mask is the flags which we should examine, written as a comma-
separated list, and the second argument comp is a comma-sepa‐
rated list of flags which must be set. Flags are: SYN ACK FIN
RST URG PSH ALL NONE. Hence the command
iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST SYN
will only match packets with the SYN flag set, and the ACK, FIN
and RST flags unset.