iptables/tc 原理

netfilter hook在IP层，linux packet filter/BPF 旁路了链路层，整个包流动见[flow].

iptables, tc对这两层都有作用。

用法[usage]:

iptables [-t table] cmd chain rules -j action

table := raw, mangle, nat, filter

cmd := -P default, -A append, -I insert, -R replace, -L list, -F delete, -N new chain.

chain := PREROUTING; FORWARD, POSTROUTING;

   INPUT, LOCALHOST, OUTPUT, POSTROUTING

rules := --in-interface, --out-interface, --proto,

  --source, --sport, --destination --dport

action := ACCEPT, DROP, REDIRECT,

  SNAT, DNAT, MASQUERADE

iptables -L -n -v #查看定义规则的详细信

raw 用来标记，绕过nat和connection tracking [raw]; 另外，也可以用来调试[debug].

[flow]这张图太重要了，在这里备份下：

[usage] http://www.linuxso.com/linuxpeixun/10332.html

[raw] http://blog.chinaunix.net/uid-10915175-id-3381754.html

[debug] http://blog.youlingman.info/debugging-iptables-with-raw-table/

[flow]  http://inai.de/images/nf-packet-flow.png