Kernel Packet Traveling Diagram

理解数据包如何穿越Linux内核将有助于学习netfilter/iptables。netfilter是Linux内核自2.4版开始采用的实现防火墙功能的机制，这个架构可以完成封包过滤（packet filtering）、网络地址转换NAT（network address translation）以及其它对数据包（packet）的操作。可作为实用手册常备案头。

                            Network
                    -----------+-----------
                               |              
                     +---------+---------+
                     |     [IPTABLES]    |
                     |    [PREROUTING]   |
                     | +-------+-------+ |
                     | |   conntrack   | |
                     | +-------+-------+ |
                     | |    mangle     | | <- MARK WRITE  
                     | +-------+-------+ |
                     | |      IMQ      | |
                     | +-------+-------+ |
                     | |      nat      | | <- DEST REWRITE
                     | +-------+-------+ |     DNAT or REDIRECT or DE-MASQUERADE
                     +---------+---------+
                               |
                       +-------+-------+
                       |      QOS      |
                       |    INGRESS    |
                       +-------+-------+
                               |
         packet is for +-------+-------+ packet is for
          this machine |     INPUT     | another address
        +--------------+    ROUTING    +-------------------+
        |              |    + PDBB     |                   |
        |              +---------------+                   |
+-------+-------+                                          |
|  [IPTABLES]   |                                          |
|    [INPUT]    |                                          |
| +-----+-----+ |                                          |
| |   mangle  | |                                          |
| +-----+-----+ |                                          |
| |   filter  | |                                          |
| +-----+-----+ |                                          |
+-------+-------+                                          |
        |                                                  |
+-------+-------+                                          |
|     Local     |                                  +-------+-------+
|    Process    |                                  |   [IPTABLES]  |
+-------+-------+                                  |   [FORWARD]   |
        |                                          | +-----+-----+ |
+-------+-------+                                  | |  mangle   | | <- MARK WRITE
|    OUTPUT     |                                  | +-----+-----+ |
|    ROUTING    |                                  | |  filter   | |
+-------+-------+                                  | +-----+-----+ |
        |                                          +-------+-------+
+-------+-------+                                          |
|   [IPTABLES]  |                                          |
|    [OUTPUT]   |                                          |
| +-----------+ |                                          |
| | conntrack | |                                          |
| +-----+-----+ |                                          |
| |   mangle  | | <- MARK WRITE                            |
| +-----+-----+ |                                          |
| |    nat    | | <-DEST REWRITE                           |
| +-----+-----+ |     DNAT or REDIRECT                     |
| |   filter  | |                                          |
| +-----+-----+ |                                          |
+-------+-------+                                          |
        |                                                  |
        +----------------------+---------------------------+
                               |
                     +---------+---------+
                     |     [IPTABLES]    |
                     |   [POSTROUTING]   |
                     | +-------+-------+ |
                     | |    mangle     | | <- MARK WRITE  
                     | +-------+-------+ |
                     | |      nat      | | <- SOURCE REWRITE
                     | +-------+-------+ |      SNAT or MASQUERADE
                     | |      IMQ      | |
                     | +-------+-------+ |
                     +---------+---------+
                               |
                        +------+------+
                        |     QOS     |
                        |    EGRESS   |
                        +------+------+
                               |
                    -----------+-----------
                            Network

• [Name of firewall chain]
• Controlled by iptables (in blue)
• Controlled by ip/tc (in red)

原图来自：http://www.docum.org/docum.org/kptd，本站引用时做了删改。