Detailed explanation of Linux system iptables rule execution order

Preliminary Knowledge (RPM): Iptable has three queue (table) rules, mangle queue, filter queue, Nat queue.

1. The mangle table which is responsible for the alteration of quality of service bits in the TCP header.

2. The second table is the filter queue which was responsible for packet filtering.

* Forward chain:filters packets to servers protected by the firewall.

* Input Chain:filters packets destined for the firewall.

* Output Chain:filters packets originating from the firewall.

3. The third table is the NAT queue which is responsible to network address translation. It has two built-in chains; These are:

* Pre-routing Chain:nats packets The destination address of the packet needs to be changed.

* Post-routing Chain:nats Packets when the source is the packet needs to be changed

Personal Summary:

When Iptables executes the rule, is executed from top to bottom from the rule table, if no matching rules are encountered, a single line is executed, if a matching rule is encountered, then the execution of these rules, followed by the actions of these rules (accept, reject, log, etc.), Deciding on the next step of implementation, there are generally three cases of follow-up execution.

1. One is to continue executing the next rule within the current rule queue. For example, after the log in the filter queue is executed, the next rule within the filter queue is also executed.

2. One is to abort execution of the current rule queue and go to the next rule queue. For example, you can break other rules in the filter queue from the execution of the accept and jump to the NAT queue rule to perform

3. One is to abort execution of all rule queues.