After reading some guides (e.g. this one) and playing with Iptables tuning I found that I see no reason for naming Iptables' tables as tables.
I mean that there practically are no tables.
E.g. having "table"
nat there are basically three chains in it -
POSTROUTING, but these chains in this table have no intersections and do not follow each other directly. So from the packet flow's point of view highlighting the concept of tables doesn't make any sense at all.
The name of "table" (
security, ...) just represents a priority of groups of rules inside chains and also some other properties (e.g.
nat group of rules work just once per-connection,
filter work per-packet and so on).
Thus it should be not "table contains several chains" but something like "chain contains groups of rules with specific global priority (and some other common properties)". Doesn't it?
Or do I misunderstand something?