netfilter nf_hooks的优先级

source/include/linux.netfilter_ipv4.h#055

052 enum nf_ip_hook_priorities {
053         NF_IP_PRI_FIRST = INT_MIN,
054         NF_IP_PRI_CONNTRACK_DEFRAG = -400,
055         NF_IP_PRI_RAW = -300,
056         NF_IP_PRI_SELINUX_FIRST = -225,
057         NF_IP_PRI_CONNTRACK = -200,
058         NF_IP_PRI_BRIDGE_SABOTAGE_FORWARD = -175,
059         NF_IP_PRI_MANGLE = -150,
060         NF_IP_PRI_NAT_DST = -100,
061         NF_IP_PRI_BRIDGE_SABOTAGE_LOCAL_OUT = -50,
062         NF_IP_PRI_FILTER = 0,
063         NF_IP_PRI_NAT_SRC = 100,
064         NF_IP_PRI_SELINUX_LAST = 225,
065         NF_IP_PRI_CONNTRACK_HELPER = INT_MAX - 2,
066         NF_IP_PRI_NAT_SEQ_ADJUST = INT_MAX - 1,
067         NF_IP_PRI_CONNTRACK_CONFIRM = INT_MAX,
068         NF_IP_PRI_LAST = INT_MAX,
069 };

文章来源于领测软件测试网 https://www.ltesting.net/