The iptables decide how to respond to a packet with one or more of the following actions based on packet contents or packet addressing:
- filter : ignore, reject, or accept the packet (firewall)
- mangle : change the packet including NAT rewrite
As shown in your diagram, appropriate iptables (in blue) can get involved before and after each routing step.
The routing tables decides where the packet will go entirely based on its addresses in the header:
- Input routing decides if it will be accepted locally (into the iptables INPUT table) or forwarded (iptables FORWARD table); if the respective ip tables are empty or the table accepts the packet, the packet is then respectively sent to a listening application or (if forwarding is enabled), sent to output routing.
- Output routing gets both forwarded packets and packets sent by applications. It then decides what network interface to send the packet to, and if it will be sent directly to its target host (on the same network with the interface), or to an external router
- The box labeled "local process" is not a routing step but represents the local applications on the system that are receiving packets or emitting new ones -- two possibly unrelated actions.
Forwarding may require a bit more explanation.
When a linux box has forwarding enabled, it is acting like a router. Typically, this means it has multiple network interfaces, and it may receive packets not addressed to the local system, but instead addressed to a network on an interface different from the one that received it. In ethernet, every packet has an ethernet (LAN) address and a IP address for both source and target. You send a packet to a WAN address by putting a router's ethernet address and the WAN IP address in the respective target addresses. Then the router (which could be another linux box) will then run that packet through its routing tables and determine the next network to send it to.