▁specification ▁of ▁which ▁packets ▁it ▁matches . ▁It ▁may ▁also ▁contain ▁a ▁target ▁( used ▁for ▁extensions ) ▁or ▁ver dict ▁( one ▁of ▁the ▁built - in ▁dec isions ). ▁As ▁a ▁packet ▁travers es ▁a ▁chain , ▁each ▁rule ▁in ▁turn ▁is ▁exam ined . ▁If ▁a ▁rule ▁does ▁not ▁match ▁the ▁packet , ▁the ▁packet ▁is ▁passed ▁to ▁the ▁next ▁rule . ▁If ▁a ▁rule ▁does ▁match ▁the ▁packet , ▁the ▁rule ▁takes ▁the ▁action ▁indicated ▁by ▁the ▁target / ver dict , ▁which ▁may ▁result ▁in ▁the ▁packet ▁being ▁allowed ▁to ▁continue ▁along ▁the ▁chain ▁or ▁may ▁not . ▁Match es ▁make ▁up ▁the ▁large ▁part ▁of ▁rules ets , ▁as ▁they ▁contain ▁the ▁conditions ▁packets ▁are ▁tested ▁for . ▁These ▁can ▁happen ▁for ▁about ▁any ▁layer ▁in ▁the ▁O SI ▁model , ▁as ▁with ▁e . g . ▁the ▁-- mac - source ▁and ▁- p ▁tcp ▁-- d port ▁parameters , ▁and ▁there ▁are ▁also ▁protocol - in dependent ▁matches , ▁such ▁as ▁- m ▁time . ▁ ▁The ▁packet ▁continues ▁to ▁traverse ▁the ▁chain ▁until ▁either ▁ ▁a ▁rule ▁matches ▁the ▁packet ▁and ▁dec ides ▁the ▁ult imate ▁fate ▁of ▁the ▁packet , ▁for ▁example ▁by ▁calling ▁one ▁of ▁the ▁A CCE PT ▁or ▁D ROP , ▁or ▁a ▁module ▁returning ▁such ▁an ▁ult imate ▁fate ; ▁or ▁ ▁a ▁rule ▁calls ▁the ▁RET URN ▁ver dict , ▁in ▁which ▁case ▁processing ▁returns ▁to ▁the ▁calling ▁chain ; ▁or ▁ ▁the ▁end ▁of ▁the ▁chain ▁is