🧱 iptables Introduction

What is iptables?

iptables is like the security guard at your front door — everyone entering or leaving must pass through inspection. The guard has a list (rule table): who can enter, who cannot, which door to use, which floor to go to — everything is recorded.

iptables is a firewall tool built into the Linux kernel, operating at the network layer (Layer 3/4), capable of filtering, forwarding, and modifying packets entering and leaving a server.

Core Concept: Tables

iptables has several "tables," each responsible for different types of operations:

Table	Purpose	Usage Frequency
filter	Filter packets (allow/deny)	⭐⭐⭐ Most commonly used
nat	Network Address Translation (NAT)	⭐⭐ Commonly used
mangle	Modify packet headers	⭐ Less commonly used
raw	Connection tracking exemption	Rarely used

Core Concept: Chains

Each table contains several "chains," like different posts for the security guard:

• 📥INPUT — Entry post: checks packets coming into the local machine
• 📤OUTPUT — Exit post: checks packets sent from the local machine
• 🔄FORWARD — Forwarding post: checks packets passing through the machine but not destined for it (router scenarios)
• 🔀PREROUTING — Pre-processing: handled before routing decisions (used for DNAT)
• 🔀POSTROUTING — Post-processing: handled after routing decisions (used for SNAT)

Packet Flow

Understanding how packets flow through iptables is like understanding how a delivery passes through various checkpoints:

Packet enters the server
    │
    ▼
┌──────────────┐
│  raw         │  PREROUTING (before connection tracking)
│  table       │
└──────┬───────┘
       ▼
┌──────────────┐
│  mangle      │  PREROUTING (modify packet headers)
│  table       │
└──────┬───────┘
       ▼
┌──────────────┐
│  nat         │  PREROUTING (DNAT: modify destination address)
│  table       │
└──────┬───────┘
       ▼
   Routing decision: for local machine? Or forward?
   ┌────┴────┐
   ▼         ▼
  Local    Forward → FORWARD → POSTROUTING → Out
   │
   ▼
┌──────────────┐
│  filter      │  INPUT (filter: allow or deny?)
│  table       │
└──────┬───────┘
       ▼
   Application receives data