postrouting

POSTROUTING is a built-in chain in the netfilter framework used by Linux firewalls and network address translation. It is evaluated after a routing decision has been made and just before packets leave the host. The chain exists in the NAT table and in the mangle table, serving different purposes in each.

In the NAT table, POSTROUTING handles address translation on outbound traffic. The most common use is source NAT (SNAT) or masquerading, which replaces the source address of packets leaving through a specified interface. A typical rule is iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE, which enables dynamic translation for packets exiting via eth0. SNAT allows specifying a fixed external address. This chain operates after routing decisions and is closely tied to connection tracking to map flows back to their original sources.

In the mangle table, POSTROUTING is used for final alterations to packet headers as they exit the host. This can include modifying TTL or DSCP/TOS fields, or marking packets for QoS or routing decisions. The mangle POSTROUTING chain is not primarily about NAT; it is used for advanced traffic management and policy enforcement just before packets leave the system.

Relation to other chains: POSTROUTING processes packets after they have been routed and after any relevant OUTPUT or FORWARD processing. For locally generated traffic, packets traverse OUTPUT, then POSTROUTING before leaving. For routed traffic, POSTROUTING is encountered as the packet is prepared to exit toward its destination. Caution is advised when placing rules here to avoid disrupting protocol behavior or causing routing issues.