|
Think of each tables like a funnel and the chains are like a sieve. If a packet qualifies, based on an algorithm applied to all incoming packets, for a particular funnel, it gets passed through that funnels sieve (the ipchains rules). Funnels can be linked so the output of one funnel can simply point to the next funnel (given certain conditions were met in the calculation of the original algorithm). So they all have to have output chains, otherwise, they effectively become "/dev/null" (until they back up into kernel space, at which point things can get ugly).
|
