Skip to content

Netfilter

links: SPA TOC - Linux Firewall - Index


Overview

Packet filtering framework

  • allows to:
    • build packet filter firewalls
    • do any kind of NAT and NAPT
    • do further packet manipulation
  • components:

netfilter-components.png

Netfilter

Provides a set of hooks inside the Linux kernel that allows kernel modules to register callback functions with the network stack

Netfilter Hooks

netfilter-hooks.png

Main features netfilter/iptables

  • stateless packet filtering
  • stateful packet filtering
  • all kind of network address and port translation (NAT/NAPT)
  • multiple layers of APIs for 3rd party extensions

Use cases netfilter/iptables

  • build internet firewall
  • use NAT and masquerading
  • use NAT to implement transparent proxies
  • aid the tc (traffic control) and iproute2 systems to build sophisticated QoS and policy routers
  • do further packet manipulation

links: SPA TOC - Linux Firewall - Index