Packet chain traversals

[Joel Newkirk <netfilter@newkirk.us>]

I've been working on a chain traversal diagram (primarily for my own reasons, 
but if anybody likes it they are welcome to use it non-commercially) and have 
a few questions.

First, the current form of the diagram is (temporarily) at 
http://newkirk.no-ip.org:83/Traversal-sm.png
and the basic rule is that a packet cannot cross a black line.  The choices of 
colors are meaningless, except to differentiate chains.

I know that the 'latest' form of netfilter has mangle AND filter chains for 
forward and input, and mangle, nat, and filter chains for output.  (Yeah, the 
diagram would be even more confusingly complicated with that detailed :^)

Can someone offer some examples of uses for mangle-forward, mangle-input, 
mangle-output, and nat-output?  I can't see much use for them, but my use of 
iptables has been fairly simple so far, and most of my comprehension is based 
on the previous version of the tutorial. (and absorbing the gobs of 
information embedded in messages here :^)

Also, I wanted to ask for clarification on a point in the latest 
iptables-tutorial "Traversing of tables and chains" section:  At one point it 
seems that packets pass through mangle-forward THEN filter-forward, (diagram) 
yet elsewhere it seems to be the reverse. (table 1)  Which is correct?

Thanks for any input, examples, diagram criticism (artistic or logical) etc.  
If your response seems to you to be useless to the list in general then 
please just send it to me directly.

j

-- 
"The problem with the French is that they don't have a word for entrepreneur." 
--George W. Bush