How Iptables works

When Iptables is able to match a connection that tries to establish itself on your system with a rule in its list, the action that takes place is called a target. A target can be a final policy decision for the packet, such as Accept or Drop. It can also be Move the packet to a different chain for processing.

A firewall rule specifies criteria for a packet and a target. If the packet does not match, the next rule in the chain is examined; and if it does match, then the next rule is specified by the value of the target, which can be the name of a userdefined chain or one of the special values like Accept, Drop, Queue or Return.