Chains A chain is a checklist of rules A rule says "if the packet looks like this, take this action" If no rule matches the packet the policy of the chain is used