What is iptables forward chain?

The FORWARD chain in iptables is used for packets that are neither generated by nor destined for the firewall itself. Instead, it handles packets that are passing through the firewall. This is crucial for any system acting as a router or gateway.

• Purpose: The primary purpose of the FORWARD chain is to decide what to do with packets that are traversing the system. This involves determining whether to allow (ACCEPT), drop (DROP), or reject (REJECT) these packets, based on defined rules.

• Traversal: When a packet arrives at the firewall, iptables evaluates whether the packet is for the firewall itself (INPUT chain) or from the firewall (OUTPUT chain). If neither, the packet is routed through the FORWARD chain. The kernel's routing table determines how the packet will be routed.

• Common Uses:

  • Network Address Translation (NAT): FORWARD rules are commonly used in conjunction with NAT, especially SNAT (Source NAT) and DNAT (Destination NAT). NAT allows you to hide internal network addresses behind a single public IP address. See Network%20Address%20Translation.
  • Routing: Implements policy based routing where routing decisions depends on firewall mark, source and destination addresses etc.
  • Firewalling Between Networks: You can use the FORWARD chain to create rules that allow or block traffic between different networks. For example, you can allow traffic from your internal network to the internet but block traffic from the internet to your internal network.
  • Port Forwarding: Forwarding specific ports to other devices on the internal network.

• Targets: The FORWARD chain supports various target actions, including:

  • ACCEPT: Allows the packet to pass through. See ACCEPT.
  • DROP: Silently discards the packet. See DROP.
  • REJECT: Drops the packet and sends an ICMP error message back to the sender. See REJECT.
  • LOG: Logs information about the packet. See LOG.
  • SNAT: Masquerades source IP address. See SNAT.
  • DNAT: Changes destination IP address. See DNAT.
  • Jump to other chains (user defined chains).

• Security Implications: Incorrectly configured FORWARD rules can create security vulnerabilities, allowing unauthorized access to internal networks. Therefore, it is important to carefully plan and test the rules.

• Example: iptables -A FORWARD -i eth0 -o wlan0 -j ACCEPT

  This rule allows all traffic forwarding from eth0 interface to wlan0 interface.