netfilter, you have to understand how a packet flows throughout the kernel, i.e. which chains (similar to a 'road check point') it visits, and which kinds of processing it gets in each chain (referred to with the term table). Processing and chains are shown in this illustration, each box have the chain in its lower part and the processing type in the upper one. (You have to focus on the Network layer.) Depending on the packet path, only a subset of chains are involved: packets flowing through your raspberry will only goes through
FORWARD chain, does not imply that it routes packets. You have to enable it using the command
sysctl -w net.ipv4.ip_forward=1 (non persistent).
Moreover, as shown in the figure, there is no
nat processing in the
FORWARD chain, only
filter, so the command
iptables -t nat -d <list of IPs> -A FORWARD -j NFQUEUE --queue-num 1
Packet processing for each table/chain is actually driven by an ordered list of rules, the table, that you define with the
iptables command. Each rule is made up of matching criteria and an action which depends on the table type (
nfqueue is only allowed in
nat tables, etc.)
Now, coming to
nfqueue. We use such action when further processing of some packets is to be made outside the kernel, by a program you create yourself (see a python example here, for instance, in intrusion detection systems. Packets are put on a queue (identified with 16-bits number), processed then returned to the kernel to resume their flow at the next table/chain. (They can also be dropped in user space).
In a common scenario, you'll typically want to send only accepted packets to userspace (those filtered are ignored at kernel level).
You have to be careful about your exact needs, which are not yet clear. I'll try to give an example to explain how it works using your scenario:
sudo iptables -F
sudo iptables -t nat -F
sudo iptables -t nat -A POSTROUTING -o $eth -j MASQUERADE
sudo iptables -A FORWARD -i $eth -o $wlan -m state --state RELATED,ESTABLISHED -j NFQUEUE --queue-num 1
sudo iptables -A FORWARD -i $wlan -o $eth -j NFQUEUE --queue-num 1
This means that packets flowing between
$wlan will be put on the same queue. You have to make sure that some program is handling queue no. 1 and ready to process packets.