ipjqs_表和链（Traversongs of tables and chains）

5 chains (PREROUTING/INPUT/FORWARD/OUTPUT/POSTROUTING)

3 tables (mangle/filter/nat | raw/security)

 ​

 

 

 

要澄清此图像，请考虑这一点。如果我们将数据包放入第一个路由决策中，该决策不是面向本地计算机本身，它将通过 FORWARD 链路由。另一方面，如果数据包发送到本地计算机正在侦听的 IP 地址，我们将通过 INPUT 链将数据包发送到本地计算机。

同样值得注意的是，数据包可能面向本地计算机，但目标地址可以通过做 NAT 在 PREROUTING 链中更改。由于此发生在第一个路由决策之前，因此在此更改后将查看数据包。因此，在路由决策完成之前，可能会更改路由。请注意，所有数据包都将在此映像中通过一条或另一条路径。如果您将数据包转回来自的同一网络，它仍将通过链的其余部分传输，直到它回到网络上。

Table 6-1. Destination local host (our own machine)

Note that this time the packet was passed through the INPUT chain instead of the FORWARD chain. Quite logical. Most probably the only thing that's really logical about the traversing of tables and chains in your eyes in the beginning, but if you continue to think about it, you'll find it will get clearer in time.

 

able 6-2. Source local host (our own machine)

In this example, we're assuming that the packet is destined for another host on another network. The packet goes through the different steps in the following fashion:

Table 6-3. Forwarded packets

As you can see, there are quite a lot of steps to pass through. The packet can be stopped at any of the iptables chains, or anywhere else if it is malformed; however, we are mainly interested in the iptables aspect of this lot. Do note that there are no specific chains or tables for different interfaces or anything like that. FORWARD is always passed by all packets that are forwarded over this firewall/router.

 

 

 

 

Mangle table

The following targets are only valid in the mangle table. They can not be used outside the mangle table.

 

Nat table

This table should only be used for NAT (Network Address Translation) on different packets. In other words, it should only be used to translate the packet's source field or destination field. Note that, as we have said before, only the first packet in a stream will hit this table. After this, the rest of the packets will automatically have the same action taken on them as the first packet. The actual targets that do these kind of things are:

 

 

Filter table

The filter table is mainly used for filtering packets. We can match packets and filter them in whatever way we want. This is the place that we actually take action against packets and look at what they contain and DROP or /ACCEPT them, depending on their content. Of course we may also do prior filtering; however, this particular table is the place for which filtering was designed. Almost all targets are usable in this table. We will be more prolific about the filter table here; however you now know that this table is the right place to do your main filtering.

 

Raw table

The raw table is mainly only used for one thing, and that is to set a mark on packets that they should not be handled by the connection tracking system. This is done by using the NOTRACK target on the packet

User specified chains

 

 

 

补充

--

Mangle简介

Mangle是一个数据包分析，但是很多RouterOS都喜欢称其为标记，但实际上标记只是mangle的一部分功能而已。

Mangle的翻译就是压碎，撕烂的意思，在路由器里面就是拆开包来研究，然后重新组合。我们就是通过mangle规则来分析数据包里面含有的关键信息，然后进行重新归类，标记，或者修改其中部分的参数。在ROS里面Mangle主要分为以下三类，以及对应的动作如下：

1.分析关注，对匹配规则的数据包进行分析关注，不对包进行其他操作

2.分析标记，对匹配规则的数据包进行分析标记，加上标记。

3.分析调整，对匹配的数据包进行拆包修改，修改数据并且重新封装。

Mangle是ROS里面动作（Action）最多的一个表，也是五链最全的，贯穿整个数据流程，见下图橙色部分：

Mangle规则的配置，就需要理解OSI七层模型和常用的数据协议包的组成原理。这样我们才能在配置Mangle规则的时候能最大化的保证数据传输效率。下一章我们以TCP/UDP协议来深入探讨一下网络传输中的一些常见问题。

 

参考：

https://www.frozentux.net/iptables-tutorial/iptables-tutorial.html#IPFILTERING

https://www.veewe.com/7-%e9%98%b2%e7%81%ab%e5%a2%99mangle%e7%ae%80%e4%bb%8b.html

https://blog.csdn.net/liwei0526vip/article/details/103104483?ops_request_misc=%257B%2522request%255Fid%2522%253A%2522160398312519724842902387%2522%252C%2522scm%2522%253A%252220140713.130102334.pc%255Fall.%2522%257D&request_id=160398312519724842902387&biz_id=0&utm_medium=distribute.pc_search_result.none-task-blog-2~all~first_rank_v2~rank_v28-1-103104483.pc_search_result_cache&utm_term=lvs&spm=1018.2118.3001.4449