IPTable related comprehension records

IPTable-related Understanding records Iptable processing mechanism IPTable is a packet filtering mechanism, which is supported and pre-installed in Linux kernel Versions later than 2.4.xx, previously, linux with 2.2.xx as the core mainly used ipchains as the filtering mechanism. IPTable provides functions such as filtering specified data packets, IP camouflage, and NAT host. The relationship between IPTables and NetfilterIPTables and Netfilter is sometimes confusing. IPTables is an extensible advanced datagram management system or an out-of-core Configuration tool based on the basic architecture of Netfilter, such as Firewall and NAT) packet records and traffic statistics are all provided by the Netfilter subsystem in the Linux kernel, and IPTables is the only tool to control Netfilter. The IPTables structure IPTable adopts the hierarchical structure of table and chain. Generally, IPTables has three Tables. Multiple chains are pre-configured in each Table, as shown in the following code) function kernel module FilterINPUT forward output packet filtering iptables_filterNatPREROUTING postrouting output is used for network address translation iptable_natManglePREROUTING postrouting input output forward to modify the transmission characteristics of data packets. command: 1 # iptables-L-n (view the filter table) 2 # iptables-t nat-L (view the Nat table) 3 # iptables-t mangle-L (view the Mangle table) five (hook) interception points (hook p Oints), these five interception points are presented as chains in IPTables, and each chain has a corresponding rule (rule ). INPUT [incoming packets apply policies in this rule chain] OUTPUT [apply policies in this rule chain for outgoing packets] FORWARD [apply policies in this rule chain when forwarding packets] PREROUTING [apply policies to packets apply the rules in this chain before routing selection.] POSTROUTING [apply the rules in this chain after routing selection of data packets]