So, if the rule number is 1, the rule or rules are inserted at the head of the chain. -I, -insert chain rule-specification Insert one or more rules in the selected chain as the given rule number.There are two versions of this command: the rule can be specified as a number in the chain (starting at 1 for the first rule) or a rule to match. -D, -delete chain rulenum Delete one or more rules from the selected chain.When the source and/or destination names resolve to more than one address, a rule will be added for each possible address combination. -A, -append chain rule-specification Append one or more rules to the end of the selected chain.For long versions of the command and option names, you need to use only enough letters to ensure that iptables can differentiate it from all other options. Only one of them can be specified on the command line unless otherwise stated below. These options specify the desired action to perform. It provides the following built-in chains: PREROUTING (for packets arriving via any network interface) OUTPUT (for packets generated by local processes) It registers at the netfilter hooks with higher priority and is thus called before ip_conntrack, or any other IP tables. raw: This table is used mainly for configuring exemptions from connection tracking in combination with the NOTRACK target.Since kernel 2.4.18, three other built-in chains are also supported: INPUT (for packets coming into the box itself), FORWARD (for altering packets being routed through the box), and POSTROUTING (for altering packets as they are about to go out). Until kernel 2.4.17 it had two built-in chains: PREROUTING (for altering incoming packets before routing) and OUTPUT (for altering locally-generated packets before routing). mangle: This table is used for specialized packet alteration.It consists of three built-ins: PREROUTING (for altering packets as soon as they come in), OUTPUT (for altering locally-generated packets before routing), and POSTROUTING (for altering packets as they are about to go out). nat: This table is consulted when a packet that creates a new connection is encountered.It contains the built-in chains INPUT (for packets destined to local sockets), FORWARD (for packets being routed through the box), and OUTPUT (for locally-generated packets). filter: This is the default table (if no -t option is passed).If the kernel is configured with automatic module loading, an attempt will be made to load the appropriate module for that table if it is not already there. -t, -table table This option specifies the packet matching table which the command should operate on.There are currently three independent tables (which tables are present at any time depends on the kernel configuration options and which modules are present). If the end of a built-in chain is reached or a rule in a built-in chain with target RETURN is matched, the target specified by the chain policy determines the fate of the packet. Please also see the NFQUEUE target as described later in this man page.) RETURN means stop traversing this chain and resume at the next rule in the previous (calling) chain. Packets with a target of QUEUE will be sent to queue number '0' in this case. Kernels 2.6.14 and later additionally include the nfnetlink_queue queue handler. 2.4.x and 2.6.x kernels up to 2.6.13 include the ip_queue queue handler. (How the packet can be received by a userspace process differs by the particular queue handler.

QUEUE means to pass the packet to userspace. DROP means to drop the packet on the floor. If the packet does not match, the next rule in the chain is the examined if it does match, then the next rule is specified by the value of the target, which can be the name of a user-defined chain or one of the special values ACCEPT, DROP, QUEUE or RETURN.ĪCCEPT means to let the packet through. A firewall rule specifies criteria for a packet and a target.

Iptables netmap example