Understanding iptables Proposed Changes

[mjkim610]

Link: https://www.linode.com/docs/guides/what-is-iptables/

Issue

In the image in the Tables section, the NAT table only contains the output, prerouting, and postrouting chain. It should also include the input chain.

Suggested Fix

The NAT table should also include the input chain.

[mjkim610]

Image location: docs/guides/security/firewalls/what-is-iptables/iptables-table-of-tables.png

[Rajakavitha1]

Hi @mjkim610
Just checked the linux man pages and the built in chains for a NAT table does not include input chain.

https://linux.die.net/man/8/iptables

Closing this issue for now. Pleas feel free to reopen if any other issues needs to be addressed.

[mjkim610]

Hi @Rajakavitha1

I think the die.net documentation is incorrect.

• https://en.wikipedia.org/wiki/Netfilter#/media/File:Netfilter-packet-flow.svg shows the input chain for NAT
• https://stuffphilwrites.com/fw-ids-iptables-flowchart-v2024-05-22/ shows the input chain for NAT
• iptables -t nat -L shows the input chain

mj@pc:[~]: sudo iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination

Please check the info above and let me know, thank you! (I don't think I have the privileges for reopening the issue)

[mjkim610]

iptables manpage v 1.8.7

              nat:
                  This table is consulted when a packet that creates a new connection is encountered.  It consists of four built-ins: PREROUTING (for altering packets as
                  soon as they come in), INPUT (for altering packets destined for local sockets), OUTPUT (for altering locally-generated  packets  before  routing),  and
                  POSTROUTING (for altering packets as they are about to go out).  IPv6 NAT support is available since kernel 3.7.

related commit: https://git.netfilter.org/iptables/commit/?id=d7b813f0a097f81c5781a6a6f08c1d41a4affead