BarbWire Help File

Add
This command appends the rule to the end of the chain. The rule will in other words always be put last in the rule set in comparison to previously added rules, and hence be checked last, unless you append or insert more rules later on.

replace
This command replaces the old entry at the specified line. It works in the same way as the delete command, but instead of totally deleting the entry, it will replace it with a new entry. This might be good while experimenting with your firewall mainly.

insert
Insert a rule somewhere in a chain. The rule is inserted at the actual number that is specified in the Rule No: box.

delete

----------------------------------------------------------------------

INPUT
Packets coming into the firewall device as destination.

FORWARD
Packets going thought the firewall, the destination may as well be your LAN or the Internet. In conjunction with PREROUTING, POSTROUTING and MASQUERADE.

OUTPUT
Packets going out from the firewall device. Destination may as well be your LAN or the internet.

PREROUTING
This target is used to ulter packets so that Internet connection can access your LAN or DMZ.
For instance, if your web site, dns server, mail server etc. is behind the firewall. PREROUTING is use in conjunction with DNAT and REDIRECT. 
The PREROUTING chain is pretty much what it says, it does network address translation on packets before they actually hit the routing decision that sends them onwards to the INPUT or FORWARD chains in the filter table. The only reason that we talk about this chain in this script is that we once again feel obliged to point out that you should not do any filtering in it. The PREROUTING chain is only traversed by the first packet in a stream, which means that all subsequent packets will go totally unchecked in this chain. 
As it is with this script, we do not use the PREROUTING chain at all, however, this is the place we would be working in right now if we wanted to do DNAT on any specific packets, for example if you want to host your web server within your local network.

POSTROUTING
Mainly use to ulter packets so that non routable IP address such as 192.168.0.0/16, 172.16.0.0/12 and 10.0.0.0/8 can access the internet. POSTROUTING is used in conjunction with SNAT and MASQUERADE.

policy