The New System: Netfilter

[0] raw (config option, may be wiped, allows promisc accounting).
[1] pre-routing (demasquerade, reverse NAT, redirect)
[2] input (packet filtering)
[3] forward (packet filtering)
[4] output (packet filtering, demasq, reverse NAT, redirect)
[5] post-routing (masquerade, de-reverse NAT)

  1. Each hook can be registered for by multiple modules. First in, first called.
  2. Can return NF_DROP, NF_ACCEPT or NF_USERSPACE.
  3. The next hook on that hook point called unless NF_DROP returned.
  4. Caching bitfield indicates what that hook examined, and if it changed the packet.
  5. nf_drop() call for registering packet drops (eg. in routing code).

Packet Filtering

  1. New filtering tool and extensible module called `ip_tables.o'; uses hooks 2, 3, and 4.
  2. Example modules: REJECT module (sends ICMP port unreachable and returns NF_DROP), and MAC module (compares MAC address).
  3. Loads whole tables instead of individual rules.
  4. Smaller than ipchains.
  5. Knows nothing about packet manipulation (eg. masquerading, NAT or redirection).

Masquerading/NAT

NAT: Network Address Translation NAPT: Network Address Port Translation Masquerading RNAT: Reverse NAT
  1. New NAT infrastructure uses hooks 1, 4 and 5.
  2. Provides understanding of ICMP, TCP and UDP by default.
  3. Different "setup" modules can be written which define a "setup type": usually a particular protocol.
  4. An ordered (most-specific to least-specific) setup table is kept, which is manipulated by userspace. When a match is found in this table, the setup type module is called to create a "connection".

Next