FILTER is the default table, traffic passes through 1 of 3 chains { INPUT, FORWARD, OUTPUT } (most of the time)
container traffic passes through FORWARD
PREROUTING, POSTROUTING only available on RAW, MANGLE
PREROUTING ─┬──── FORWARD ────┬─ POSTROUTING
│ │
INPUT │ │ OUTPUT
│ │
└─ local process ─┘
chain modifiers:
selectors:
actions:
iptables -P FORWARD ACCEPT
iptables -A FORWARD -s 0.0.0.0/0 -d 1.2.3.4/32 -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -m conntrack --cstate RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -m conntrack --cstate RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -m conntrack --cstate RELATED,ESTABLISHED -j ACCEPT