What is netfilter/iptables?
netfilter and iptables are building blocks of a framework inside the Linux 2.4.x and 2.6.x kernel. This
framework enables packet filtering, network address [and port] translation
(NA[P]T) and other packet mangling. It is the re-designed and heavily improved
successor of the previous Linux 2.2.x ipchains
and Linux 2.0.x ipfwadm systems.
netfilter is a set of hooks inside the Linux kernel that allows kernel modules
to register callback functions with the network stack. A registered callback
function is then called back for every packet that traverses the respective
hook within the network stack.
iptables is a generic table structure for the definition of rulesets. Each
rule within an IP table consists of a number of classifiers (iptables
matches) and one connected action (iptables target).
netfilter, iptables and the connection tracking as well as the NAT subsystem
together build the whole framework.
- stateless packet filtering (IPv4 and IPv6)
- stateful packet filtering (IPv4)
- all kinds of network address and port translation (NAT/NAPT)
- flexible and extensible infrastructure
- multiple layers of API's for 3rd party extensions
- large number of plugins/modules kept in 'patch-o-matic' repository
What can I do with netfilter/iptables?- build internet firewalls based on stateless and stateful packet filtering
- use NAT and masquerading for sharing internet access if you don't have enough public IP addresses
- use NAT to implement transparent proxies
- aid the tc and iproute2 systems used to build sophisticated QoS and policy routers
- do further packet manipulation (mangling) like altering the TOS/DSCP/ECN bits of the IP header
|
