• iptables. I have went though the manual of Iptables and known some basic concepts, e.g. chain, table, hook, rule and targets. In the Linux ecosystem, iptables is a widely used firewall tool that interfaces with the kernel’s netfilter packet filtering framework.

  • route table. In Linux, there is another table route table.

I am trying to figure out the relation between them and put them in one big picture.

Here is a nice diagram to show the flow of iptables, there are two route stages. in which step, will kernel take advantage of "route table"?

enter image description here


  1. DigitalOcean: A Deep Dive into Iptables and Netfilter Architecture
  2. I have read this question "StackOverflow: What's the difference between iptables vs route?", but it didn't answer my question.
  • That diagram is really nice. In details, it is more precise than the original KPTD. Not sure if this is your own work, more importantly I haven't found it elsewhere - so I've upvoted your question exactly for the diagram.
    – frr
    Apr 2, 2023 at 10:01

2 Answers 2


The iptables decide how to respond to a packet with one or more of the following actions based on packet contents or packet addressing:

  • filter : ignore, reject, or accept the packet (firewall)
  • mangle : change the packet including NAT rewrite

As shown in your diagram, appropriate iptables (in blue) can get involved before and after each routing step.

The routing tables decides where the packet will go entirely based on its addresses in the header:

  • Input routing decides if it will be accepted locally (into the iptables INPUT table) or forwarded (iptables FORWARD table); if the respective ip tables are empty or the table accepts the packet, the packet is then respectively sent to a listening application or (if forwarding is enabled), sent to output routing.
  • Output routing gets both forwarded packets and packets sent by applications. It then decides what network interface to send the packet to, and if it will be sent directly to its target host (on the same network with the interface), or to an external router
  • The box labeled "local process" is not a routing step but represents the local applications on the system that are receiving packets or emitting new ones -- two possibly unrelated actions.

Forwarding may require a bit more explanation. When a linux box has forwarding enabled, it is acting like a router. Typically, this means it has multiple network interfaces, and it may receive packets not addressed to the local system, but instead addressed to a network on an interface different from the one that received it. In ethernet, every packet has an ethernet (LAN) address and a IP address for both source and target. You send a packet to a WAN address by putting a router's ethernet address and the WAN IP address in the respective target addresses. Then the router (which could be another linux box) will then run that packet through its routing tables and determine the next network to send it to.


In both "route" steps. One is for incoming packets, one for packets created from local applications.

Note that iptables and routing are intended for two totally different concepts: Routing answers the question "where should this packet be delivered to?", while iptables answers the question "do I need to filter or somehow treat this packet specially?"

While you can abuse the filtering process to force the packet to be delivered somewhere, that's not the original intention, but too many people on the internet think they somehow have to do it that way. (Sorry about the rant, it's one of my pet peeves).

  • so you are saying the Linux route table will be used on both highlighted steps in the diagram, am I understanding correctly?
    – Ryan Lyu
    Apr 4, 2022 at 7:15
  • Input routing is looking at "does this packet belong to this host" and "are any applications listening on this source address and source port", so if it is using the routing tables, it's not using it the same way.
    – user10489
    Apr 4, 2022 at 11:29
  • @user10489 exactly, so the whole "route" step in this case also includes the decision "is this for a local interface, or do I need to forward it", which is included in the "where" question. So the two "route" steps are not the same.
    – dirkt
    Apr 4, 2022 at 15:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .