FM / html

/usr/share/doc/iptables/html

Name	Size	Mode	Actions
NAT-HOWTO-1.html	1152	0644	edit dl rm
NAT-HOWTO-2.html	4346	0644	edit dl rm
NAT-HOWTO-3.html	1444	0644	edit dl rm
NAT-HOWTO-4.html	4400	0644	edit dl rm
NAT-HOWTO-5.html	5139	0644	edit dl rm
NAT-HOWTO-6.html	8397	0644	edit dl rm
NAT-HOWTO-7.html	1324	0644	edit dl rm
NAT-HOWTO-8.html	1136	0644	edit dl rm
NAT-HOWTO-9.html	2091	0644	edit dl rm
NAT-HOWTO-10.html	2525	0644	edit dl rm
NAT-HOWTO-11.html	910	0644	edit dl rm
NAT-HOWTO.html	2666	0644	edit dl rm
netfilter-extensions-HOWTO-1.html	2102	0644	edit dl rm
netfilter-extensions-HOWTO-2.html	7807	0644	edit dl rm
netfilter-extensions-HOWTO-3.html	28969	0644	edit dl rm
netfilter-extensions-HOWTO-4.html	12548	0644	edit dl rm
netfilter-extensions-HOWTO-5.html	7041	0644	edit dl rm
netfilter-extensions-HOWTO-6.html	11242	0644	edit dl rm
netfilter-extensions-HOWTO-7.html	2188	0644	edit dl rm
netfilter-extensions-HOWTO-8.html	1021	0644	edit dl rm
netfilter-extensions-HOWTO-9.html	2222	0644	edit dl rm
netfilter-extensions-HOWTO.html	7267	0644	edit dl rm
netfilter-hacking-HOWTO-1.html	7474	0644	edit dl rm
netfilter-hacking-HOWTO-2.html	1718	0644	edit dl rm
netfilter-hacking-HOWTO-3.html	8038	0644	edit dl rm
netfilter-hacking-HOWTO-4.html	53338	0644	edit dl rm
netfilter-hacking-HOWTO-5.html	1056	0644	edit dl rm
netfilter-hacking-HOWTO-6.html	3028	0644	edit dl rm
netfilter-hacking-HOWTO-7.html	9288	0644	edit dl rm
netfilter-hacking-HOWTO-8.html	5234	0644	edit dl rm
netfilter-hacking-HOWTO-9.html	835	0644	edit dl rm
netfilter-hacking-HOWTO.html	3811	0644	edit dl rm
packet-filtering-HOWTO-1.html	1891	0644	edit dl rm
packet-filtering-HOWTO-2.html	1593	0644	edit dl rm
packet-filtering-HOWTO-3.html	5775	0644	edit dl rm
packet-filtering-HOWTO-4.html	2189	0644	edit dl rm
packet-filtering-HOWTO-5.html	1644	0644	edit dl rm
packet-filtering-HOWTO-6.html	3505	0644	edit dl rm
packet-filtering-HOWTO-7.html	35616	0644	edit dl rm
packet-filtering-HOWTO-8.html	1457	0644	edit dl rm
packet-filtering-HOWTO-9.html	2333	0644	edit dl rm
packet-filtering-HOWTO-10.html	2575	0644	edit dl rm
packet-filtering-HOWTO-11.html	3742	0644	edit dl rm
packet-filtering-HOWTO.html	2831	0644	edit dl rm

Edit: /usr/share/doc/iptables/html/packet-filtering-HOWTO-6.html (3505B)

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<HTML>
<HEAD>
 <META NAME="GENERATOR" CONTENT="LinuxDoc-Tools 0.9.82">
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <TITLE>Linux 2.4 Packet Filtering HOWTO: How Packets Traverse The Filters</TITLE>
 <LINK HREF="packet-filtering-HOWTO-7.html" REL=next>
 <LINK HREF="packet-filtering-HOWTO-5.html" REL=previous>
 <LINK HREF="packet-filtering-HOWTO.html#toc6" REL=contents>
</HEAD>
<BODY>
<A HREF="packet-filtering-HOWTO-7.html">Next</A>
<A HREF="packet-filtering-HOWTO-5.html">Previous</A>
<A HREF="packet-filtering-HOWTO.html#toc6">Contents</A>
<HR>
<H2><A NAME="s6">6.</A> <A HREF="packet-filtering-HOWTO.html#toc6">How Packets Traverse The Filters</A></H2>

The kernel starts with three lists of rules in the `filter' table;
these lists are called firewall chains or just
chains. The three chains are called INPUT,
OUTPUT and FORWARD.

The three circles represent the three chains mentioned above. When
a packet reaches a circle in the diagram, that chain is examined to
decide the fate of the packet. If the chain says to DROP the packet,
it is killed there, but if the chain says to ACCEPT the packet, it
continues traversing the diagram.

A chain is a checklist of rules. Each rule says `if the packet
header looks like this, then here's what to do with the packet'. If
the rule doesn't match the packet, then the next rule in the chain is
consulted. Finally, if there are no more rules to consult, then the
kernel looks at the chain policy to decide what to do. In a
security-conscious system, this policy usually tells the kernel to
DROP the packet.

<OL>
<LI>When a packet comes in (say, through the Ethernet card) the kernel
first looks at the destination of the packet: this is called
`routing'.
</LI>
<LI>If it's destined for this box, the packet passes downwards
in the diagram, to the INPUT chain. If it passes this, any processes
waiting for that packet will receive it.
</LI>
<LI>Otherwise, if the kernel does not have forwarding enabled, or it
doesn't know how to forward the packet, the packet is dropped. If
forwarding is enabled, and the packet is destined for another network
interface (if you have another one), then the packet goes rightwards
on our diagram to the FORWARD chain. If it is ACCEPTed, it will be
sent out.
</LI>
<LI>Finally, a program running on the box can send network packets.
These packets pass through the OUTPUT chain immediately: if it says
ACCEPT, then the packet continues out to whatever interface it is
destined for.</LI>
</OL>

<HR>
<A HREF="packet-filtering-HOWTO-7.html">Next</A>
<A HREF="packet-filtering-HOWTO-5.html">Previous</A>
<A HREF="packet-filtering-HOWTO.html#toc6">Contents</A>
</BODY>
</HTML>

cmd: