iptables-(pci-review).md

@@ -14,18 +14,6 @@ There are three default chains defined for the filter table:
 
 A target must be applied to at least one of the above chains to be in use. A chain target that is not in use, but defined, may be used based on settings.  For example, a wifi network may be configured with a quota or limited to certain hours.  We do not use those settings or provide a means to configure them on our production tablets.
 
-```mermaid
-graph TD;
-INPUT --> bw_input;
-INPUT --> fw_INPUT;
-FORWARD --> oem_fwd;
-FORWARD --> fw_FORWARD;
-FORWARD --> natctrl_FORWARD;
-OUTPUT --> oem_out;
-OUTPUT --> fw_OUTPUT;
-OUTPUT --> st_OUTPUT;
-OUTPUT --> bw_OUTPUT;
-```
 
 ```
 Chain INPUT (policy ACCEPT)
@@ -51,6 +39,21 @@ fw_OUTPUT  all  --  anywhere             anywhere
 st_OUTPUT  all  --  anywhere             anywhere            
 bw_OUTPUT  all  --  anywhere             anywhere            
 ```
+
+### Chain targets from INPUT,FORWARD and OUTPUT chains:
+```mermaid
+graph TD;
+INPUT --> bw_input;
+INPUT --> fw_INPUT;
+FORWARD --> oem_fwd;
+FORWARD --> fw_FORWARD;
+FORWARD --> natctrl_FORWARD;
+OUTPUT --> oem_out;
+OUTPUT --> fw_OUTPUT;
+OUTPUT --> st_OUTPUT;
+OUTPUT --> bw_OUTPUT;
+```
+
 ```
 Chain bw_FORWARD (1 references)
 target     prot opt source               destination