SWAT /

IP Tables Hook Points

Reading

Outdoors

Games

Hobbies

LEGO

Food

Code

Events

Nook

sidebar

IP Tables Hook Points

Netfilter Hooks/IPTables Chains

This diagram outlines the netfilter hookpoints; it is taken from here.

       --->PRE------>[ROUTE]--->FWD---------->POST------>
           Conntrack    |       Mangle   ^    Mangle
           Mangle       |       Filter   |    NAT (Src)
           NAT (Dst)    |                |    Conntrack
           (QDisc)      |             [ROUTE]
                        v                |
                        IN Filter       OUT Conntrack
                        |  Conntrack     ^  Mangle
                        |  Mangle        |  NAT (Dst)
                        v                |  Filter

The corresponding IPTables chain identifiers are:

  • PRE: PREROUTING
  • IN: INPUT
  • OUT: OUTPUT
  • FWD: FORWARD
  • POST: POSTROUTING

However, not all are accessible in each IPTables table; these are the standards:

  • filter: Basic packet capture. Provides FORWARD, INPUT, OUTPUT.
  • nat: Consulted when a packet creates a new connection. Provides PREROUTING, POSTROUTING, OUTPUT.
  • mangle: General packet manipulation. Provides PREROUTING, POSTROUTING, OUTPUT, INPUT, FORWARD.
  • raw: Happens before connection tracking or any other tables are applied. Provides PREROUTING.

iptables assumes the filter table is being used unless specified otherwise (i.e. using "-t").

Recent Changes (All) | Edit SideBar Page last modified on December 19, 2007, at 08:14 AM Edit Page | Page History