iptables ：chains, target

iptables In the package processing path of the kernel , Defined 5 individual “hook points” :

• PREROUTING
• INPUT
• FORWARD
• POSTROUTING
• OUTPUT

 filter It can only happen

• INPUT 
• OUTPUT 
• FORWARD

nat It can only happen in

• PREROUTING 
• POSTROUTING
• OUTPUT

INPUT and FORWARD The difference between ：

After the network packets arrive at the device , after PREROUTING after , If the destination address is local , after INPUT Give to the The related process , If the destination address is not local , Pass by FORWARD chain .

REF: Linux Network Administrator’s Guide, Third Edition