Understanding iptables Proposed Changes

linode / docs

Linode guides and tutorials.

https://www.linode.com/docs/

1.38k stars 1.22k forks source link

Understanding iptables Proposed Changes #7131

Open mjkim610 opened 1 month ago

mjkim610 commented 1 month ago

Link: https://www.linode.com/docs/guides/what-is-iptables/

Issue

In the image in the Tables section, the NAT table only contains the output, prerouting, and postrouting chain. It should also include the input chain.

Suggested Fix

The NAT table should also include the input chain.

mjkim610 commented 1 month ago

Image location: docs/guides/security/firewalls/what-is-iptables/iptables-table-of-tables.png

Rajakavitha1 commented 3 weeks ago

Hi @mjkim610 Just checked the linux man pages and the built in chains for a NAT table does not include input chain.

https://linux.die.net/man/8/iptables

Closing this issue for now. Pleas feel free to reopen if any other issues needs to be addressed.

mjkim610 commented 2 weeks ago

Hi @Rajakavitha1

I think the die.net documentation is incorrect.

https://en.wikipedia.org/wiki/Netfilter#/media/File:Netfilter-packet-flow.svg shows the input chain for NAT
https://stuffphilwrites.com/fw-ids-iptables-flowchart-v2024-05-22/ shows the input chain for NAT

iptables -t nat -L shows the input chain


mj@pc:[~]: sudo iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination

Chain INPUT (policy ACCEPT) target prot opt source destination

Chain OUTPUT (policy ACCEPT) target prot opt source destination

Chain POSTROUTING (policy ACCEPT) target prot opt source destination



Please check the info above and let me know, thank you! (I don't think I have the privileges for reopening the issue)

mjkim610 commented 2 weeks ago

iptables manpage v 1.8.7

              nat:
                  This table is consulted when a packet that creates a new connection is encountered.  It consists of four built-ins: PREROUTING (for altering packets as
                  soon as they come in), INPUT (for altering packets destined for local sockets), OUTPUT (for altering locally-generated  packets  before  routing),  and
                  POSTROUTING (for altering packets as they are about to go out).  IPv6 NAT support is available since kernel 3.7.