It looks at IP packets coming over a network interface, and based upon a defined ruleset, modifies the packet in some way and sends it out over an interface.

• 它检查到达网络接口的IP包,根据事先定义好的规则进行修改,然后再转发给其它接口。