• RETURN: interrupt processing of the current chain and return to the calling chain; in case
the current chain is a standard one, there’s no calling chain, so the default action (defined
with the -P option to
iptables
) is executed instead.
• SNAT (only in the nat table): apply
Source Network Address Translation (SNAT). Extra options
describe the exact changes to apply, including the --to-source
address
:
port
option, which
defines the new source IP address and/or port.
• DNAT (only in the nat table): apply
Destination Network Address Translation (DNAT). Extra op-
tions describe the exact changes to apply, including the --to-destination
address
:
port
option,
which defines the new destination IP address and/or port.
• MASQUERADE (only in the nat table): apply
masquerading (a special case of
Source NAT).
• REDIRECT (only in the nat table): transparently redirect a packet to a given port of the
firewall itself; this can be used to set up a transparent web proxy that works with no con-
figuration on the client side, since the client thinks it connects to the recipient whereas the
communications actually go through the proxy. The --to-ports
port(s)
option indicates the
port, or port range, where the packets should be redirected.
Other actions, particularly those concerning the mangle table, are outside the scope of this text.
The
iptables(8)
and
ip6tables(8)
manual pages have a comprehensive list.
