Kernel Packet Traveling Diagram(图片，关于iptables)

       
转自：view-source:http://www.docum.org/docum.org/kptd/

                           Network

                    -----------+-----------

                               |

                  +--------------------------+

          +-------+-------+        +---------+---------+

          |    IPCHAINS   |        |      IPTABLES     |

          |     INPUT     |        |     PREROUTING    |

          +-------+-------+        | +-------+-------+ |

                  |                | |   conntrack   | |

                  |                | +-------+-------+ |

                  |                | |    mangle     | | <- MARK WRITE  

                  |                | +-------+-------+ |

                  |                | |      IMQ      | |

                  |                | +-------+-------+ |

                  |                | |      nat      | | <- DEST REWRITE

                  |                | +-------+-------+ |     DNAT or REDIRECT or DE-MASQUERADE

                  |                +---------+---------+

                  +------------+-------------+

                               |

                       +-------+-------+

                       |      QOS      |

                       |    INGRESS    |

                       +-------+-------+

                               |

         packet is for +-------+-------+ packet is for

          this machine |     INPUT     | another address

        +--------------+    ROUTING    +--------------+

        |              |    + PDBB     |              |

        |              +---------------+              |

+-------+-------+                                     |

|   IPTABLES    |                                     |

|     INPUT     |                                     |

| +-----+-----+ |                                     |

| |   mangle  | |                                     |

| +-----+-----+ |                                     |

| |   filter  | |                                     |

| +-----+-----+ |                                     |

+-------+-------+                                     |

        |                               +---------------------------+

+-------+-------+                       |                           |

|     Local     |               +-------+-------+           +-------+-------+

|    Process    |               |    IPCHAINS   |           |    IPTABLES   |

+-------+-------+               |    FORWARD    |           |    FORWARD    |

        |                       +-------+-------+           | +-----+-----+ |

+-------+-------+                       |                   | |  mangle   | | <- MARK WRITE

|    OUTPUT     |                       |                   | +-----+-----+ |

|    ROUTING    |                       |                   | |  filter   | |

+-------+-------+                       |                   | +-----+-----+ |

        |                               |                   +-------+-------+

+-------+-------+                       |                           |

|    IPTABLES   |                       +---------------------------+

|     OUTPUT    |                                     |

| +-----------+ |                                     |

| | conntrack | |                                     |

| +-----+-----+ |                                     |

| |   mangle  | | <- MARK WRITE                       |

| +-----+-----+ |                                     |

| |    nat    | | <-DEST REWRITE                      |

| +-----+-----+ |     DNAT or REDIRECT                |

| |   filter  | |                                     |

| +-----+-----+ |                                     |

+-------+-------+                                     |

        |                                             |

        +----------------------+----------------------+

                               |

                  +------------+------------+

                  |                         |

          +-------+-------+       +---------+---------+

          |    IPCHAINS   |       |      IPTABLES     |

          |     OUTPUT    |       |    POSTROUTING    |

          +-------+-------        | +-------+-------+ |

                  |               | |    mangle     | | <- MARK WRITE  

                  |               | +-------+-------+ |

                  |               | |      nat      | | <- SOURCE REWRITE

                  |               | +-------+-------+ |      SNAT or MASQUERADE

                  |               | |      IMQ      | |

                  |               | +-------+-------+ |

                  |               +---------+---------+

                  +------------+------------+

                               |

                        +------+------+

                        |     QOS     |

                        |    EGRESS   |

                        +------+------+

                               |

                    -----------+-----------

                            Network