Manpage of IPTABLES
A firewall rule specifies criteria for a packet, and a target. If the packet does not match, the next rule in
the chain is the examined; if it does match, then the next rule is specified by the value of the target, which
can be the name of a user-defined chain or one of the special values ACCEPT, DROP, QUEUE, or
RETURN.
ACCEPT means to let the packet through. DROP means to drop the packet on the floor. QUEUE means
to pass the packet to userspace (if supported by the kernel). RETURN means stop traversing this chain
and resume at the next rule in the previous (calling) chain. If the end of a built-in chain is reached or a
rule in a built-in chain with target RETURN is matched, the target specified by the chain policy
determines the fate of the packet.
TABLES
There are currently three independent tables (which tables are present at any time depends on the kernel
configuration options and which modules are present).
-t, --table table
This option specifies the packet matching table which the command should operate on. If the
kernel is configured with automatic module loading, an attempt will be made to load the
appropriate module for that table if it is not already there.
The tables are as follows:
filter
This is the default table (if no -t option is passed). It contains the built-in chains INPUT (for
packets coming into the box itself), FORWARD (for packets being routed through the box), and
OUTPUT (for locally-generated packets).
nat
This table is consulted when a packet that creates a new connection is encountered. It consists of
three built-ins: PREROUTING (for altering packets as soon as they come in), OUTPUT (for
altering locally-generated packets before routing), and POSTROUTING (for altering packets as
they are about to go out).
mangle
This table is used for specialized packet alteration. Until kernel 2.4.17 it had two built-in chains:
PREROUTING (for altering incoming packets before routing) and OUTPUT (for altering locally-
generated packets before routing). Since kernel 2.4.18, three other built-in chains are also
supported: INPUT (for packets coming into the box itself), FORWARD (for altering packets
being routed through the box), and POSTROUTING (for altering packets as they are about to go
out).
http://www.iptablesrocks.org/syntax/man_iptables.htm (2 of 20) [2/13/2004 8:04:51 PM]
