3

After reading some guides (e.g. this one) and playing with Iptables tuning I found that I see no reason for naming Iptables' tables as tables.
I mean that there practically are no tables.
E.g. having "table" nat there are basically three chains in it - PREROUTING, OUTPUT and POSTROUTING, but these chains in this table have no intersections and do not follow each other directly. So from the packet flow's point of view highlighting the concept of tables doesn't make any sense at all.
The name of "table" (raw, filter, nat, mangle, security, ...) just represents a priority of groups of rules inside chains and also some other properties (e.g. nat group of rules work just once per-connection, filter work per-packet and so on).

Thus it should be not "table contains several chains" but something like "chain contains groups of rules with specific global priority (and some other common properties)". Doesn't it?

Or do I misunderstand something?

3
  • "The name of "table" just represents a priority of groups of rules inside chains" -- do you mean the fact that e.g. the PREROUTING chains of raw, mangle and nat tables are processed at around the the same time, in a particular order? AFAIU, it's not just the order though, but tables do do different things. e.g. you can't use SNAT in the filter table. How much that is just about splitting different kinds of decisions to different places, and how much relates to other stuff the code does, I don't know. (then again, IIRC, e.g. the nat table is only checked for new connections.)
    – ilkkachu
    Mar 30 at 12:32
  • 1
    Anyway, I'm not exactly sure if it's just the name "table", you're questioning, or the fact that there are multiple different tables (with chains of the same name), regardless of the name chosen?
    – ilkkachu
    Mar 30 at 12:33
  • 1
    @ilkkachu "do you mean the fact that e.g. the PREROUTING chains of raw, mangle and nat tables are processed at around the the same time, in a particular order?" - yep. "tables do do different things. e.g. you can't use SNAT in the filter table" - doesn't it just a priority issue? It seems that we can just have several global priorities which can be applied or not to specific chain.
    – z0lupka
    Mar 30 at 13:26
0

The name tables is of historical origin:

  • Once, there were simple rules.
  • Then, there were ipchains - rules could have been chained.
  • A major rewrite of all the firewalling system resulted in a filter, that kept a table of states for all connections (and connection-like thinks like upd request and appropriate answer). Hence the 'table' name. And also rules for different parts of the process of a packet traversing one of paths (e. g. a packet for our system, that shall be received) can be organized into a few tables of rules (INPUT, FORWARD, OUTPUT, PREROUTING, POSTROUTING).

A history summarized above is swiftly describe here: https://netfilter.org/about.html#history.

6
  • "rules...can be organized into a few tables of rules (INPUT, FORWARD, OUTPUT, PREROUTING, POSTROUTING)" - didn't get it. INPUT, FORWARD, OUTPUT, PREROUTING, POSTROUTING are chains. What do you mean?
    – z0lupka
    Mar 30 at 16:51
  • If you try to imagine, what's going on, it helps (at least to some of us) to see the filtering process as a few "checklists". If you plan to start an airplane, you first need to pickup proper checklist (basically pieces of paper) and go through them. Similarly when you are receiving a packet, the packet need to go through some "papers" with some inspection rules on them. If it passes them all, it's accepted and processed.
    – d.c.
    Mar 30 at 19:10
  • "a table of states for all connections" -- isn't that conntrack? It's not like the states of connections are in the iptables tables, right? (Also, INPUT, FORWARD etc. are chains, not tables.)
    – ilkkachu
    Mar 30 at 19:16
  • @ikkachu Yes, it's conntrack. In old times of ipchains, connections were not tracked.
    – d.c.
    Mar 30 at 20:28
  • 2
    @d.c. "If it passes them all, it's accepted and processed" - nope. It can be accepted and "processed"(whatever that means) even when it pass just several of them, e.g. PREROUTING and INPUT. "try to imagine" - I don't need, because I know the packet traversal through the Linux kernel network stack. But I still don't understand the concept of tables. Also I still don't understand why are you calling "INPUT, FORWARD, OUTPUT, PREROUTING, POSTROUTING" tables while these are chains?
    – z0lupka
    Mar 31 at 9:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.