INBOUND (firewall as destination)
- mangle-prerouting
- nat-prerouting
- filter-input

OUTBOUND (firewall as source)
- mangle-output
- nat-output
- filter-output
- nat-postrouting

FORWARDING (passing through unaltered)
- mangle-prerouting
- nat-prerouting
- filter-forward
- nat-postrouting

MASQ (private to public)
- nat-prerouting
- filter-forward
- nat-postrouting (masq done here)
