Trace a packet through netfilter for traffic to the host, through the host and from the host.
Show the answer
Say this first
Every packet that arrives hits PREROUTING (raw, then conntrack, mangle, nat DNAT), then the routing decision. If it is for this host it goes to INPUT; if it is to be routed it goes to FORWARD and then POSTROUTING (where SNAT happens). Locally created packets are routed first, then go through OUTPUT and POSTROUTING. DNAT happens before routing so the new destination decides the path; SNAT happens last so filter rules still see the original source.
Go deeper
The three paths
to the host: in -> PREROUTING -> routing -> INPUT -> local process
through the host: in -> PREROUTING -> routing -> FORWARD -> POSTROUTING -> out
from the host: local process -> routing -> OUTPUT -> POSTROUTING -> outTable order inside each hook
| Hook | Order |
|---|---|
| PREROUTING | raw, conntrack, mangle, nat (DNAT) |
| INPUT | mangle, filter, security, nat (SNAT for local delivery, rare) |
| FORWARD | mangle, filter, security |
| OUTPUT | raw, conntrack, mangle, nat (DNAT), filter, security |
| POSTROUTING | mangle, nat (SNAT, MASQUERADE) |
These come from the hook priorities: raw -300, conntrack -200, mangle -150, DNAT -100, filter 0, security 50,
SNAT 100. nftables uses the same numbers, which is why its chains declare priority filter or priority srcnat.
Consequences interviewers ask about
- A port-forward needs a FORWARD rule that matches the inside address and port, because DNAT already happened in PREROUTING.
- A MASQUERADE rule does not change what FORWARD sees: the source is still the private address there.
- Traffic to the router's own address hits INPUT, never FORWARD, even if it arrived on the "outside".
- The nat table is consulted only for the first packet; later packets reuse the conntrack entry.
- After OUTPUT, if mangle changed the mark or nat changed the destination, the kernel re-routes the packet.
They will ask next
Do bridged frames go through iptables?
Only if the
br_netfiltermodule is loaded andnet.bridge.bridge-nf-call-iptables=1. Then bridged IPv4 frames pass the FORWARD chain too. Docker and Kubernetes load it, which is why bridged traffic can suddenly be dropped by a FORWARD policy of DROP.Which chains does the reply from the host's own web server traverse?
OUTPUT then POSTROUTING. It is a locally generated packet. The incoming request went PREROUTING then INPUT.
Traps
- Writing the FORWARD rule with the public IP for a port-forward. After DNAT, FORWARD sees the private one.
- Expecting INPUT rules to protect containers or VMs behind the host. Their traffic goes through FORWARD.