学习iptables需要知道的一句话

Whenever you do not understand how the kernel code process a command from user space, I encourage you to look at the user-space tool source code and see how the command from the user is packaged and sent to the kernel.