Netfilter Hooks/IPTables Chains
This diagram outlines the netfilter hookpoints; it is taken from here.
--->PRE------>[ROUTE]--->FWD---------->POST------>
Conntrack | Mangle ^ Mangle
Mangle | Filter | NAT (Src)
NAT (Dst) | | Conntrack
(QDisc) | [ROUTE]
v |
IN Filter OUT Conntrack
| Conntrack ^ Mangle
| Mangle | NAT (Dst)
v | Filter
The corresponding IPTables chain identifiers are:
- PRE: PREROUTING
- IN: INPUT
- OUT: OUTPUT
- FWD: FORWARD
- POST: POSTROUTING
However, not all are accessible in each IPTables table; these are the standards:
- filter: Basic packet capture. Provides FORWARD, INPUT, OUTPUT.
- nat: Consulted when a packet creates a new connection. Provides PREROUTING, POSTROUTING, OUTPUT.
- mangle: General packet manipulation. Provides PREROUTING, POSTROUTING, OUTPUT, INPUT, FORWARD.
- raw: Happens before connection tracking or any other tables are applied. Provides PREROUTING.
iptables
assumes the filter table is being used unless specified otherwise (i.e. using "-t").