Tweeted twitter.com/#!/StackUnix/status/390997550234615809
2 edited tags
| link
1
source | link

What is the difference between OUTPUT and FORWARD chains in iptables?

CentOS 6.0

I'm studying iptables and am getting confused on the difference between FORWARD and OUTPUT chains. In my training documentation, it states:

If you're appending to (-A) or deleting from (-D) a chain, you'll want to apply it to network data traveling in one of three directions:

  • INPUT - All incoming packets are checked against the rules in this chain.
  • OUTPUT - All outgoing packets are checked against the rules in this chain.
  • FORWARD - All packets being sent to another computer are checked against the rules in this chain.

This confuses me because, in my mind, packets leaving for a host WOULD be outgoing. So are there scenarios where a packet would be going to another computer but NOT be "outgoing"? How would iptables distinguish between the two?