what’s the agreement of -m?

not tcp, it’s “tcp –dport 80”

-m matches, using a somewhat complicated “module matching” mechanism. There are a bunch of pretty cool modules in iptables, for example “recent”.