firewalls

What is netfilter/iptables?

Netfilter and iptables are building blocks of a framework inside the Linux 2.4.x and 2.6.x kernel. This framework enables packet filtering, network addresses [and port] translation (NA[P]T) and other packet mangling. It is the re-designed and heavily improved successor of the previous Linux 2.2.x ipchains and Linux 2.0.x ipfwadm systems. Netfilter is a set of hooks inside the Linux kernel that allows kernel modules to register callback functions with the network stack. A registered callback function is then called back for every packet that traverses the respective hook within the network stack. Iptables is a generic table structure for the definition of rulesets. Each rule within an IP table consists out of a number of classifiers (iptables matches) and one connected action (iptables target). Netfilter, iptables and the connection tracking as well as the NAT subsystem together build the whole framework.

Main Features

• • stateless packet filtering (IPv4 and IPv6)

  • stateful packet filtering (IPv4)

  • all kinds of network address and port translation (NAT/NAPT)

  • flexible and extensible infrastructure

  • multiple layers of API's for 3rd party extensions

  • large number of plug-ins/modules kept in 'patch-o-matic' repository

What can I do with netfilter/iptables?

• • build Internet firewalls based on stateless and stateful packet filtering

  • use NAT and masquerading for sharing Internet access if you don't have enough public IP addresses

  • use NAT to implement transparent proxies

  • aid the tc and iproute2 systems used to build sophisticated QoS and policy routers

  • do further packet manipulation (mangling) like altering the TOS/DSCP/ECN bits of the IP header