求iptables各链区别的详细资料。。。。

驱魔圣手

各位大神。。。最近在看iptables，但是对3个表中的重合链的区别分的不是很清楚，比如说filter中的output链和nat中的output链的区别。。。能给出点例子说明一下吗？麻烦懂的讲解一下哈。。。。

q1208c

man iptables

1. TABLES
   
2.        There are currently three independent tables (which tables are present at any time depends on the kernel configuration options and which modules are present).
   
3. 
   
4.        -t, --table table
   
5.               This option specifies the packet matching table which the command should operate on.  If the kernel is configured with automatic module loading, an attempt will be made  to
   
6.               load the appropriate module for that table if it is not already there.
   
7. 
   
8.               The tables are as follows:
   
9. 
   
10.               filter:
    
11.                   This  is the default table (if no -t option is passed). It contains the built-in chains INPUT (for packets destined to local sockets), FORWARD (for packets being routed
    
12.                   through the box), and OUTPUT (for locally-generated packets).
    
13. 
    
14.               nat:
    
15.                   This table is consulted when a packet that creates a new connection is encountered.  It consists of three built-ins: PREROUTING (for altering packets as  soon  as  they
    
16.                   come in), OUTPUT (for altering locally-generated packets before routing), and POSTROUTING (for altering packets as they are about to go out).
    
17. 
    
18.               mangle:
    
19.                   This  table  is  used  for specialized packet alteration.  Until kernel 2.4.17 it had two built-in chains: PREROUTING (for altering incoming packets before routing) and
    
20.                   OUTPUT (for altering locally-generated packets before routing).  Since kernel 2.4.18, three other built-in chains are also supported: INPUT (for packets coming into the
    
21.                   box itself), FORWARD (for altering packets being routed through the box), and POSTROUTING (for altering packets as they are about to go out).
    
22. 
    
23.               raw:
    
24.                   This  table  is used mainly for configuring exemptions from connection tracking in combination with the NOTRACK target.  It registers at the netfilter hooks with higher
    
25.                   priority and is thus called before ip_conntrack, or any other IP tables.  It provides the following built-in chains: PREROUTING (for packets arriving  via  any  network
    
26.                   interface) OUTPUT (for packets generated by local processes)
    

复制代码

驱魔圣手

老大，能给点详细的例子不。。。回复 2# q1208c


   

q1208c

回复 3# 驱魔圣手

上面的 man 中 已经说明的很明白了.

我不是很常用 iptables. 也没有很多现成的例子.

下面的图出自 http://en.wikipedia.org/wiki/Netfilter, 可以参考一下.