Linux/iptables

Tables	Chains
FILTER	INPUT FORWARD OUTPUT
NAT	PREROUTING OUTPUT POSTROUTING
MANGLE (modify ip headers)	PREROUTING INPUT FORWARD OUTPUT POSTROUTING
RAW (connection tracking)	PREROUTING OUTPUT
(SECURITY) (SELinux)	INPUT FORWARD OUTPUT

Targets	valid in	note
REJECT	INPUT, FORWARD, OUTPUT	sends response back
DROP		no response
ACCEPT
RETURN
MASQUERADE	POSTROUTING
REDIRECT	NAT:PREROUTING + NAT:OUTPUT

Basics

iptables
         -A (append - add rule at end)             -i (input interface)          -j (target)
         -C (check)                                -o (output interface)
         -D (delete - remove rule)                 -s (source address)    
         -F (flush - remove all rules)             -d (destination address)
         -I (insert - add at position)              
         -L (list - show all rules in chain)       -p      (protocol (tcp/udp))
         -N (new chain)                            --dport (destination port)
         -X (delete chain)                         --sport (source port)

         -t (table to manipulate (default: filter)

         -n (numeric output of addresses and ports)

View state

iptables-save                  # show everything

iptables --list-rules          # list filter rules (default: filter)
iptables --list-rules -t nat   # list nat rules

raspi wifi to ethernet

rc.local
- iptables --table nat --append POSTROUTING --out-interface wlan0 -j MASQUERADE
- iptables --append FORWARD --in-interface eth0 -j ACCEPT

Links