I've just noticed that this is missing the nat table's INPUT chain, which I presume goes between mangle and filter. I've not got .svg experience so am not volunteering to fix it up; if anybody does it might be worth putting in a marker (e.g. †) to identify the location of the omitted security chains. MarkMLl (talk) 15:25, 10 March 2018 (UTC)[reply]
This presumably was added in kernel 3.0, checking accessible systems I can see that it's not in 2.6.26 but is in 3.2.14. MarkMLl (talk) 13:23, 11 March 2018 (UTC)[reply]
I'll try to take a look at this but I'm not promising when. Could also usefully have a TSO marker on the NICs, since monitoring input using PCAP etc. shows reassembled frames rather than what's on the wire. MarkMLl (talk) 08:21, 18 April 2018 (UTC)[reply]
