I run dnsmasq locally as a cache server, in the old days, I allow all INPUT packets from lo+, and set policy of INPUT to DROP:
-A INPUT -i lo+ -j ACCEPT
Now I decide to put this on the raw
table to speed up rules matching,
-A PREROUTING -i lo+ -j ACCEPT
But that doesn't work as expected. Why? Since the packets get processed by the raw table first, then nat, then filter, why isn't that rule work the same as the old one?