During the lifecycle of "iptables", in which step, will kernel take advantage of "route table"?

Question

• iptables. I have went though the manual of Iptables and known some basic concepts, e.g. chain, table, hook, rule and targets. In the Linux ecosystem, iptables is a widely used firewall tool that interfaces with the kernel’s netfilter packet filtering framework.

• route table. In Linux, there is another table route table.

I am trying to figure out the relation between them and put them in one big picture.

Here is a nice diagram to show the flow of iptables, there are two route stages. in which step, will kernel take advantage of "route table"?

Reference

1. DigitalOcean: A Deep Dive into Iptables and Netfilter Architecture
2. I have read this question "StackOverflow: What's the difference between iptables vs route?", but it didn't answer my question.

Answer 1

The iptables decide how to respond to a packet with one or more of the following actions based on packet contents or packet addressing:

• filter : ignore, reject, or accept the packet (firewall)
• mangle : change the packet including NAT rewrite

As shown in your diagram, appropriate iptables (in blue) can get involved before and after each routing step.

The routing tables decides where the packet will go entirely based on its addresses in the header:

• Input routing decides if it will be accepted locally (into the iptables INPUT table) or forwarded (iptables FORWARD table); if the respective ip tables are empty or the table accepts the packet, the packet is then respectively sent to a listening application or (if forwarding is enabled), sent to output routing.
• Output routing gets both forwarded packets and packets sent by applications. It then decides what network interface to send the packet to, and if it will be sent directly to its target host (on the same network with the interface), or to an external router
• The box labeled "local process" is not a routing step but represents the local applications on the system that are receiving packets or emitting new ones -- two possibly unrelated actions.

Forwarding may require a bit more explanation. When a linux box has forwarding enabled, it is acting like a router. Typically, this means it has multiple network interfaces, and it may receive packets not addressed to the local system, but instead addressed to a network on an interface different from the one that received it. In ethernet, every packet has an ethernet (LAN) address and a IP address for both source and target. You send a packet to a WAN address by putting a router's ethernet address and the WAN IP address in the respective target addresses. Then the router (which could be another linux box) will then run that packet through its routing tables and determine the next network to send it to.

Answer 2

In both "route" steps. One is for incoming packets, one for packets created from local applications.

Note that iptables and routing are intended for two totally different concepts: Routing answers the question "where should this packet be delivered to?", while iptables answers the question "do I need to filter or somehow treat this packet specially?"

While you can abuse the filtering process to force the packet to be delivered somewhere, that's not the original intention, but too many people on the internet think they somehow have to do it that way. (Sorry about the rant, it's one of my pet peeves).