A packet arrives on a Linux host's network interface. Which netfilter hooks does it traverse if it is addressed to a local process, and which if the host forwards it to another machine? Where does the routing decision sit in that sequence?

## The five hooks Netfilter places five hooks in the kernel's IP path. Both `iptables` chains and nftables base chains attach to them, and the classic chain names are the hook names: - **PREROUTING** — every packet that has just come off an interface and passed basic sanity checks, before the kernel has decided where it is going. - **INPUT** — packets the routing decision determined are addressed to this host. - **FORWARD** — packets the routing decision determined belong to some other host and that this machine will route onward. - **OUTPUT** — packets generated by a local process. - **POSTROUTING** — everything on its way out of an interface, whether forwarded or locally generated. ## The three paths **Inbound to a local process:** PREROUTING → routing decision → INPUT → socket. This is the path of an SSH connection to the box, or a request to a web server running on it. **Forwarded through the box:** PREROUTING → routing decision → FORWARD → POSTROUTING → wire. This is the path of a router, a NAT gateway, or a host bridging traffic for virtual machines. **Generated locally:** routing decision → OUTPUT → POSTROUTING → wire. Note the ordering: a locally generated packet is routed *before* OUTPUT, because the kernel needs a source address and an outgoing interface to construct the packet in the first place. Those paths are mutually exclusive. A packet that reaches INPUT will never reach FORWARD, which is why a rule written in FORWARD to protect a service running on this host does nothing at all — the classic way to convince yourself you have firewalled something when you have not. ## Why the routing decision's position matters The routing decision is not a hook, but it is the most important landmark in the diagram, because two things depend on being on the correct side of it. **Destination NAT must come before it.** If you rewrite the destination address after routing, the packet has already been assigned a path based on the *old* destination — it will be delivered locally or sent out the wrong interface. That is precisely why the DNAT verdict is only available in PREROUTING (for arriving traffic) and OUTPUT (for locally generated traffic). **Source NAT must come after it.** The whole point of source rewriting on a gateway is usually to make the packet appear to come from the address of the interface it is leaving by, and that interface is only known once routing has run. Hence SNAT and MASQUERADE live in POSTROUTING. There is a subtlety on the OUTPUT path: because a locally generated packet has already been routed when it reaches OUTPUT, a DNAT applied there forces the kernel to *re-run* the routing lookup afterwards, so the new destination is honoured. ## What runs at each hook Several tables can register at one hook, and the priority decides the order. At PREROUTING, for example, a packet passes raw, then connection tracking, then mangle, then destination NAT. At POSTROUTING it passes mangle and then source NAT. Filtering conventionally sits at priority 0 at INPUT, FORWARD and OUTPUT. ## Bridged traffic is different If the machine is switching frames between ports of a Linux bridge rather than routing them, that traffic does not traverse the IP hooks at all by default — it goes through the separate bridge hooks. Pushing bridged traffic through the IP hooks requires the `br_netfilter` module, which is a distinct behaviour worth knowing about because it surprises people who expect their IP firewall to see everything crossing the box. ## Reasoning with the map Once the map is internalised, a whole class of questions answers itself. Where do you block traffic to a service on this host? INPUT. Where do you block traffic between two networks this box routes? FORWARD. Where do you rewrite an inbound port to an internal server? PREROUTING. Where do you hide a private network behind one address? POSTROUTING. Why does a rule in a chain never match? Usually because the packet takes a different one of the three paths than you assumed.