Prerouting

HotSpot
In

Connection
Tracking

Mangle
Prerouting

Input

Mangle
Input

Filter
Input

Global HTB

Forward

Bridge
Decision

TTL=TTL-1

Mangle
Forward

Filter
Forward

Accounting

Output

Bridge
Decision

Connection
Tracking

Mangle
Output

Filter
Output

Bridge
Adjustm.

Postrouting

Mangle
Postrouting

SRC-NAT

HotSpot
Out

Global HTB

DST-NAT

ROUTER LOCAL
yes

no

Decapsulete

Router
processes

Local Input

Local Output

ROUTING
yes

Network Layer

K
no

IPv4 or IPv6
Treffic

IPSec
Decryption

yes

yes

IPSec
Encryption

no

Routing
Decision

Input

Routing
Decision

IPSec
Policy

Output

no
OUTPUT

INPUT

IPSec
Policy

IPv4 or IPv6
Treffic

no

yes

Prerouting

Forward

Postrouting

FORWARD

MPLS
Decision

Switch Label
(MPLS Forward)

PUSH Label
(MPLS Output)

yes

MPLS Treffic
(TAG present)

no

yes

H
FORWARD

BRIDGING
Layer - 3
Prerouting

Forward

yes

Postrouting

B
yes
no

Use IP
Firewall

no

Use IP
Firewall

In-interface
Bridge

yes

Bridge
Input

Bridge
Decision

Bridge
SRC-NAT

Bridge
DST-NAT

Bridge
Forward

Bridge
Output

no

no

Bridge
Decision

OUTPUT

Use IP
Firewall

yes

INPUT

FORWARD

no
Encapsulete

IN-INTERFACE
LOGICAL

HTB Interface

HTB Interface

IN-INTERFACE
PHYSICAL

OUT-INTERFACE
PHYSICAL

OUT-INTERFACE
LOGICAL

OUT

yes

IN

Data link Layer

yes

no

Out-interface
Bridge

DECAPSULATION
(TE, VPLS, VLAN, Tunnel)

MPLS Treffic
(TAG present)

POP Label
(MPLS Output)

MPLS
Decision

OUTPUT

no

VPLS or TE
tunnel

INPUT

DECAPSULATION
(TE, VPLS, VLAN, Tunnel)

MPLS