Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have some "trusted IPs" that I want to allow full access to my machine with "minimal performance impact". The PREROUTING -t mangle is the first chain a packet will pass, entering the system. Is it valid/allowed to use an -j ACCEPT in the PREROUTING -t mangle Chain??

I am not sure this is allowed, as the PREROUTING chain is before(!!) the internal ROUTING. What happens if I accept a packet in the PREROUTING Chain, will this packet then nevertheless be routed correctly or will -j ACCEPT lead to "bypassing" the Routing?

share|improve this question

No. You should setup all allow/denies in your filter chain only. Mangle is meant for altering packets in some way.

You could use mangle to setup a fwmark on the traffic if it matches a series of IP addresses and then permit the traffic via a fwmark instead.

share|improve this answer

In iptables, ACCEPT basically means "done processing this chain, pass the packet to the next chain".

You don't have to do anything in the mangle table; the routing will happen whether you do something there or not. Well, as long as you don't DROP the packet, of course :)

I think the following page will help you understand. It contains 2 nice diagrams on how a packet traverses the netfilter/iptables chains. The first one is more intuitive, the second is more canonical (but sadly out-of-date):

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.