All you need to know about iptables
All you need to know about iptables

If you want to get more information on how iptables works, just have a look on this site.

You will find this useful diagram :
tables_traverse

How the iptables rules are processed ? What is the processing order ?

Destination local host (our own machine)
Step Table Chain Comment
1 On the wire (e.g., Internet)
2 Comes in on the interface (e.g., eth0)
3 mangle PREROUTING This chain is normally used for mangling packets, i.e., changing TOS and so on.
4 nat PREROUTING This chain is used for DNAT mainly. Avoid filtering in this chain since it will be bypassed in certain cases.
5 Routing decision, i.e., is the packet destined for our local host or to be forwarded and where.
6 mangle INPUT At this point, the mangle INPUT chain is hit. We use this chain to mangle packets, after they have been routed, but before they are actually sent to the process on the machine.
7 filter INPUT This is where we do filtering for all incoming traffic destined for our local host. Note that all incoming packets destined for this host pass through this chain, no matter what interface or in which direction they came from.
8 Local process/application (i.e., server/client program)
Source local host (our own machine)
Step Table Chain Comment
1 Local process/application (i.e., server/client program)
2 Routing decision. What source address to use, what outgoing interface to use, and other necessary information that needs to be gathered.
3 mangle OUTPUT This is where we mangle packets, it is suggested that you do not filter in this chain since it can have side effects.
4 nat OUTPUT This chain can be used to NAT outgoing packets from the firewall itself.
5 filter OUTPUT This is where we filter packets going out from the local host.
6 mangle POSTROUTING The POSTROUTING chain in the mangle table is mainly used when we want to do mangling on packets before they leave our host, but after the actual routing decisions. This chain will be hit by both packets just traversing the firewall, as well as packets created by the firewall itself.
7 nat POSTROUTING This is where we do SNAT as described earlier. It is suggested that you don’t do filtering here since it can have side effects, and certain packets might slip through even though you set a default policy of DROP.
8 Goes out on some interface (e.g., eth0)
9 On the wire (e.g., Internet)
Forwarded packets
Step Table Chain Comment
1 On the wire (i.e., Internet)
2 Comes in on the interface (i.e., eth0)
3 mangle PREROUTING This chain is normally used for mangling packets, i.e., changing TOS and so on.
4 nat PREROUTING This chain is used for DNAT mainly. SNAT is done further on. Avoid filtering in this chain since it will be bypassed in certain cases.
5 Routing decision, i.e., is the packet destined for our local host or to be forwarded and where.
6 mangle FORWARD The packet is then sent on to the FORWARD chain of the mangle table. This can be used for very specific needs, where we want to mangle the packets after the initial routing decision, but before the last routing decision made just before the packet is sent out.
7 filter FORWARD The packet gets routed onto the FORWARD chain. Only forwarded packets go through here, and here we do all the filtering. Note that all traffic that’s forwarded goes through here (not only in one direction), so you need to think about it when writing your rule-set.
8 mangle POSTROUTING This chain is used for specific types of packet mangling that we wish to take place after all kinds of routing decisions has been done, but still on this machine.
9 nat POSTROUTING This chain should first and foremost be used for SNAT. Avoid doing filtering here, since certain packets might pass this chain without ever hitting it. This is also where Masquerading is done.
10 Goes out on the outgoing interface (i.e., eth1).
11 Out on the wire again (i.e., LAN).

Reference

Source

All you need to know about iptables

Leave a Reply

Your email address will not be published. Required fields are marked *