LFCE 74 🐧 iptables — Tables and Chains - KandZ

⏱️ Estimated read: 12 min | |

The previous chapter introduced the basic syntax and the default filter table. This chapter examines the table and chain model in detail: which tables exist, which chains belong to each table, and the order in which a packet traverses them. The model is not arbitrary. Each table is consulted at a specific point in the packet’s journey, and a rule placed in the wrong table or chain has no effect on the traffic it was meant to control. The LFCE exam expects the candidate to know which chain processes which kind of packet, and why the nat table’s PREROUTING chain is not the same as the filter table’s INPUT chain .

Quick How-To Guides & Fast FixesNeed a quick fix or step-by-step solution? Browse our fast answers on HowTo.KandZ.me:

Operating Systems CLI →Dev Environment Languages →Web Network Tools →Security Accounts →Security Access Tech →Device Phone Basics →Social Messaging →Digital Files Media →

The kernel provides five tables: filter, nat, mangle, raw, and security . The filter table is the default and contains the rules that accept, drop, or reject packets. The nat table contains the rules that translate addresses and ports. The mangle table contains the rules that modify packet headers. The raw table is used for connection-tracking exemptions. The security table is used for mandatory access control rules. Most configurations use only filter and nat; the other tables are for specialized cases .

Key point: Not every table contains every chain. The filter table has INPUT, FORWARD, and OUTPUT. The nat table has PREROUTING, OUTPUT, and POSTROUTING. The mangle table has all five chains. The chain names are shared across tables, but the rules in nat PREROUTING are evaluated at a different point in the packet’s journey than the rules in filter INPUT . A DNAT rule belongs in nat PREROUTING, not in filter INPUT, because the address translation must happen before the routing decision.

Why the table and chain model requires explicit understanding

The traversal-order problem.

A packet that arrives on an interface is processed by the raw PREROUTING chain, then the mangle PREROUTING chain, then the nat PREROUTING chain. After the routing decision, the packet is processed by the mangle INPUT chain and the filter INPUT chain if it is destined for the local host, or by the mangle FORWARD and filter FORWARD chains if it is passing through . The order is fixed, and a rule in a later chain cannot undo a decision made in an earlier chain. A DROP in filter INPUT discards the packet after the nat PREROUTING rules have already run.

The table-purpose problem.

The filter table is for filtering. The nat table is for translation. A rule that accepts or drops a packet belongs in filter, and a rule that changes the destination address belongs in nat. The mangle table is for header modification, such as changing the TTL or the TOS field. A rule placed in the wrong table may appear to work in a simple test, but it will not behave as intended when the packet flow is more complex .

The built-in-chain problem.

Each table has built-in chains that correspond to the Netfilter hooks. The filter table’s INPUT chain is for packets destined for the local host. The FORWARD chain is for packets routed through the host. The OUTPUT chain is for packets originated by the host. A host that is not a router does not use the FORWARD chain, and a rule placed there has no effect unless ip_forward is enabled .

a. The filter table and its chains

The filter table is the default. It contains the INPUT, FORWARD, and OUTPUT chains, and it is where the accept and drop rules belong.

# List the filter table rules
sudo iptables -L -n -v

# List only the INPUT chain
sudo iptables -L INPUT -n -v

The -L flag lists the rules in the default filter table. The output shows the three chains and their policies. The INPUT chain processes packets that are destined for the local host. The FORWARD chain processes packets that are routed through the host. The OUTPUT chain processes packets that the host originates .

The policy of each chain is the action taken when no rule matches. The default policy is ACCEPT, which allows all traffic that is not explicitly denied. A secure configuration sets the INPUT and FORWARD policies to DROP and adds explicit rules for the required services.

# Set the INPUT policy to DROP
sudo iptables -P INPUT DROP

The -P flag sets the policy. The DROP policy denies all incoming traffic that is not explicitly allowed. The ACCEPT policy allows all traffic that is not explicitly denied .

b. The nat table and its chains

The nat table is used for address translation. It contains the PREROUTING, OUTPUT, and POSTROUTING chains. The PREROUTING chain processes packets before the routing decision, and it is where DNAT rules belong. The POSTROUTING chain processes packets after the routing decision, and it is where SNAT and MASQUERADE rules belong .

# List the nat table rules
sudo iptables -t nat -L -n -v

# Example: DNAT a port to an internal server
sudo iptables -t nat -A PREROUTING -p tcp --dport 8080 -j DNAT --to-destination 192.168.1.10:80

The -t nat flag selects the nat table. The PREROUTING chain is evaluated before the routing decision, so a DNAT rule there changes the destination address before the kernel decides where to send the packet. A DNAT rule in filter INPUT would be too late, because the routing decision has already been made .

The POSTROUTING chain is where the source address is translated. The MASQUERADE target is a special form of SNAT that uses the outgoing interface’s address, which is appropriate for dynamic addresses. The SNAT target uses a fixed address.

# Masquerade outgoing traffic on eth0
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

The -o eth0 match specifies the outgoing interface. The MASQUERADE target rewrites the source address to the interface’s address, which allows the internal hosts to reach the internet through the router .

c. The mangle, raw, and security tables

The mangle table is used for header modification. It contains all five chains, and it is consulted at multiple points in the packet’s journey. The raw table is used for connection-tracking exemptions, and it contains the PREROUTING and OUTPUT chains. The security table is used for mandatory access control rules .

# List the mangle table
sudo iptables -t mangle -L -n -v

# List the raw table
sudo iptables -t raw -L -n -v

The mangle table is rarely needed in a basic firewall. It is used for advanced cases, such as changing the TTL of packets or marking packets for routing decisions. The raw table is used when a packet should not be tracked by the connection-tracking subsystem, which is a specialized case. The security table is used when SELinux or another MAC system needs to enforce network rules .

Complete Example Session

# ============================================
# PART 1: LIST THE DEFAULT TABLE
# ============================================
sudo iptables -L -n -v
# Output shows the filter table's INPUT, FORWARD, and OUTPUT chains

# ============================================
# PART 2: LIST THE NAT TABLE
# ============================================
sudo iptables -t nat -L -n -v
# Output shows the nat table's PREROUTING, OUTPUT, and POSTROUTING chains

# ============================================
# PART 3: LIST THE MANGLE TABLE
# ============================================
sudo iptables -t mangle -L -n -v
# Output shows the mangle table's chains

# ============================================
# PART 4: ADD A FILTER RULE
# ============================================
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT
# The rule is added to the filter table's INPUT chain

# ============================================
# PART 5: ADD A NAT RULE
# ============================================
sudo iptables -t nat -A PREROUTING -p tcp --dport 8080 -j DNAT --to-destination 192.168.1.10:80
# The rule is added to the nat table's PREROUTING chain

# ============================================
# PART 6: VERIFY THE RULES
# ============================================
sudo iptables -L INPUT -n -v
sudo iptables -t nat -L PREROUTING -n -v
# Both rules are visible in their respective tables

# ============================================
# PART 7: SET THE POLICY
# ============================================
sudo iptables -P INPUT DROP
sudo iptables -P FORWARD DROP
# The filter table's INPUT and FORWARD policies are now DROP

# ============================================
# PART 8: CHECK THE PACKET COUNTERS
# ============================================
sudo iptables -L INPUT -n -v
# The pkts and bytes columns show how many packets matched each rule

The eight parts demonstrate the table and chain model: listing the default table, listing the nat table, listing the mangle table, adding a filter rule, adding a nat rule, verifying the rules, setting the policy, and checking the counters. The critical distinction is between Parts 4 and 5: the filter rule goes in INPUT, and the nat rule goes in PREROUTING.

Quick Reference

Tables and Their Chains

Table	Chains	Purpose
`filter`	`INPUT`, `FORWARD`, `OUTPUT`	Accept, drop, reject
`nat`	`PREROUTING`, `OUTPUT`, `POSTROUTING`	Address/port translation
`mangle`	All five	Header modification
`raw`	`PREROUTING`, `OUTPUT`	Connection-tracking exemptions
`security`	`INPUT`, `FORWARD`, `OUTPUT`	MAC networking rules

Chain Purposes

Chain	Packets
`PREROUTING`	Arrive before routing decision
`INPUT`	Destined for the local host
`FORWARD`	Routed through the host
`OUTPUT`	Originated by the host
`POSTROUTING`	Leave after routing decision

Commands

Command	Purpose
`iptables -L`	List filter table
`iptables -t nat -L`	List nat table
`iptables -t mangle -L`	List mangle table
`iptables -A CHAIN`	Append rule
`iptables -P CHAIN TARGET`	Set policy

Targets

Target	Action
`ACCEPT`	Allow the packet
`DROP`	Silently discard
`REJECT`	Discard with error response
`DNAT`	Change destination address
`SNAT`	Change source address
`MASQUERADE`	SNAT to interface address

Best Practices

✅ Do This:

# Put filter rules in the filter table
iptables -A INPUT -p tcp --dport 22 -j ACCEPT                 # ✅

# Put DNAT rules in nat PREROUTING
iptables -t nat -A PREROUTING -p tcp --dport 8080 -j DNAT ... # ✅

# Put SNAT rules in nat POSTROUTING
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE          # ✅

# Set the filter policies
iptables -P INPUT DROP                                        # ✅

# List the nat table when debugging translation
iptables -t nat -L -n -v                                      # ✅

❌ Don’t Do This:

# Put a DNAT rule in filter INPUT
iptables -A INPUT -j DNAT --to-destination 192.168.1.10       # ❌

# Put a filter rule in the nat table
iptables -t nat -A PREROUTING -p tcp --dport 22 -j ACCEPT    # ❌

# Assume the FORWARD chain affects local traffic
iptables -A FORWARD -p tcp --dport 80 -j ACCEPT    # Local traffic bypasses it # ❌

# Forget the -t flag for nat rules
iptables -A PREROUTING -j DNAT ...    # PREROUTING does not exist in filter # ❌

# Use the wrong chain for the routing stage
iptables -t nat -A POSTROUTING -j DNAT ...    # Too late for DNAT # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
DNAT rule has no effect	Placed in `filter INPUT`	Use `nat PREROUTING`
`PREROUTING` chain not found	Used default `filter` table	Add `-t nat` or `-t mangle`
FORWARD rules ignored	Host is not a router	Enable `ip_forward`
Policy does not apply	Rules are in a different table	Check `-t` and the chain name
SNAT rule has no effect	Placed in `PREROUTING`	Use `nat POSTROUTING`

Real-World Examples

1. List filter table

iptables -L -n -v

2. List nat table

iptables -t nat -L -n -v

3. List mangle table

iptables -t mangle -L -n -v

4. Add filter rule

iptables -A INPUT -p tcp --dport 22 -j ACCEPT

5. Add DNAT rule

iptables -t nat -A PREROUTING -p tcp --dport 8080 -j DNAT --to-destination 192.168.1.10:80

6. Add SNAT rule

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

7. Set policy

iptables -P INPUT DROP

8. List a specific chain

iptables -L INPUT -n --line-numbers

9. Flush a table

iptables -t nat -F

10. Check packet counters

iptables -L INPUT -n -v

Visual

Table and Chain Traversal

┌──────────────────────────────────────────────────────────────┐
│  A PACKET TRAVERSES THE TABLES IN A FIXED ORDER              │
│                                                              │
│  Incoming packet                                             │
│       │                                                      │
│       ▼                                                      │
│  raw PREROUTING                                              │
│       │                                                      │
│       ▼                                                      │
│  mangle PREROUTING                                           │
│       │                                                      │
│       ▼                                                      │
│  nat PREROUTING  ← DNAT rules here                          │
│       │                                                      │
│       ▼                                                      │
│  Routing decision                                            │
│       │                                                      │
│       ├── Local host → mangle INPUT → filter INPUT          │
│       │                                                      │
│       └── Forward → mangle FORWARD → filter FORWARD         │
│                                                              │
│  Locally generated packet                                    │
│       │                                                      │
│       ▼                                                      │
│  raw OUTPUT → mangle OUTPUT → nat OUTPUT → filter OUTPUT    │
│       │                                                      │
│       ▼                                                      │
│  mangle POSTROUTING → nat POSTROUTING ← SNAT rules here     │
└──────────────────────────────────────────────────────────────┘

Table-Chain Matrix

┌──────────────────────────────────────────────────────────────┐
│  NOT EVERY TABLE HAS EVERY CHAIN                             │
│                                                              │
│  ┌──────────┬────────┬────────┬────────┬─────────┬────────┐ │
│  │ Table    │ INPUT  │ FORWARD│ OUTPUT │ PREROUT │ POSTROUT│ │
│  ├──────────┼────────┼────────┼────────┼─────────┼────────┤ │
│  │ filter   │   ✓    │   ✓    │   ✓    │         │        │ │
│  │ nat      │        │        │   ✓    │   ✓     │   ✓    │ │
│  │ mangle   │   ✓    │   ✓    │   ✓    │   ✓     │   ✓    │ │
│  │ raw      │        │        │   ✓    │   ✓     │        │ │
│  │ security │   ✓    │   ✓    │   ✓    │         │        │ │
│  └──────────┴────────┴────────┴────────┴─────────┴────────┘ │
└──────────────────────────────────────────────────────────────┘

Why DNAT Belongs in nat PREROUTING

┌──────────────────────────────────────────────────────────────┐
│  DNAT MUST HAPPEN BEFORE THE ROUTING DECISION                │
│                                                              │
│  ✅ Correct:                                                 │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ nat PREROUTING: DNAT to 192.168.1.10:80                │  │
│  │ → destination changed before routing                   │  │
│  │ → kernel routes to 192.168.1.10                        │  │
│  └────────────────────────────────────────────────────────┘  │
│                                                              │
│  ❌ Incorrect:                                               │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ filter INPUT: DNAT to 192.168.1.10:80                  │  │
│  │ → routing decision already made                        │  │
│  │ → the packet was destined for the local host           │  │
│  │ → DNAT is too late                                     │  │
│  └────────────────────────────────────────────────────────┘  │
└──────────────────────────────────────────────────────────────┘

Summary

Item	Value
Default table	`filter`
`filter` chains	`INPUT`, `FORWARD`, `OUTPUT`
`nat` chains	`PREROUTING`, `OUTPUT`, `POSTROUTING`
`mangle` chains	All five
`raw` chains	`PREROUTING`, `OUTPUT`
`security` chains	`INPUT`, `FORWARD`, `OUTPUT`
DNAT location	`nat PREROUTING`
SNAT location	`nat POSTROUTING`
Filter rules	`filter INPUT`/`FORWARD`/`OUTPUT`
Table selection	`-t <table>`

Key takeaways:

The filter table is the default and contains the accept/drop rules. Its chains are INPUT, FORWARD, and OUTPUT. The INPUT chain is for packets destined for the local host, the FORWARD chain is for packets routed through the host, and the OUTPUT chain is for packets originated by the host .
The nat table is for address translation. Its chains are PREROUTING, OUTPUT, and POSTROUTING. DNAT rules belong in PREROUTING, and SNAT rules belong in POSTROUTING. A DNAT rule in filter INPUT is too late, because the routing decision has already been made .
The mangle table is for header modification. It contains all five chains and is consulted at multiple points. It is rarely needed in a basic firewall.
Not every table contains every chain. The filter table does not have a PREROUTING chain, and the nat table does not have an INPUT chain. A rule placed in a non-existent chain produces an error .
The chain order is fixed. A packet traverses raw, mangle, and nat PREROUTING before the routing decision, then mangle and filter INPUT or FORWARD, and finally mangle and nat POSTROUTING. A rule in a later chain cannot undo a decision made in an earlier chain .
The -t flag selects the table. Without it, the command operates on the filter table. A nat rule without -t nat is either an error or a rule in the wrong table.

Remember: iptables is organized into tables and chains. The filter table is the default and handles accept/drop decisions. The nat table handles address translation. The mangle table handles header modification. Each table has its own set of chains, and the chains are traversed in a fixed order. The INPUT chain is for local delivery, the FORWARD chain is for routing, and the PREROUTING and POSTROUTING chains are for translation before and after the routing decision. A rule in the wrong table or chain has no effect. The -t flag selects the table, and the chain name selects the path. Understand the traversal order, and the rules will work as intended.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!