8 7 6 5 4 3 2 1

H nat Target Exts: MASQUERADE, SNAT H

mangle Target Exts: DSCP, MARK, ECN, TOS.
Non-Term Target Exts: LOG, ULOG
NOTE: Routing must be enabled in the
kernel in order to use the FORWARD
chain.
POSTROUTING
Chain
mangle then,
G nat then, G
conntrack
Targets: ACCEPT, DROP, QUEUE & RETURN.
Target Exts: TCPMSS, REJECT.
nat Target Exts: DNAT & REDIRECT
mangle Target Exts: DSCP, MARK, ECN, TOS.
Non-Term Target Exts: LOG, ULOG

F OUTPUT F
Chain
conntrack then,
mangle then,
nat then,
filter

Logical Get_Src_IP FORWARD Logical

E Interface
A Rtn_Src_IP
IP
Routing Process Chain
mangle then,
filter
Interface
B
E

INPUT
Chain
filter then, Targets: ACCEPT, DROP, QUEUE & RETURN.
conntrack then,
No Route! Target Exts: TCPMSS, REJECT.
Interface Chains:
D mangle mangle Target Exts: DSCP, MARK, ECN, TOS. -i: INPUT, FORWARD & PREROUTING D
Non-Term Target Exts: LOG, ULOG -o: OUTPUT, FORWARD & POSTROUTING

Std. Targets: ACCEPT, DROP, QUEUE & RETURN. Bit

Target Exts: TCPMSS, REJECT.
mangle Target Exts: DSCP, MARK, ECN, TOS.
Non-Term Target Exts: LOG, ULOG

C C
PREROUTING
Chain
conntrack then,
mangle then,
nat

B nat Target Exts: DNAT & REDIRECT. B

mangle Target Exts: DSCP, MARK, ECN & TOS.
Non-Term Target Exts: LOG & ULOG.
Output Flow Local Host Revisions
jrc Orig: 12/16/01
Yukon Networks
jrc Rev: 03/03/04
Input Flow Local Host
jrc Rev: 03/10/04 IPTables Flow Chart
A Routed Flow Intrfc - Intrfc Network Design Tok, AK A
Jim Cliver DWG.
Scale: No Scale Sheet 1 of 1
8 7 6 5 4 3 2 1