The New System: Netfilter

[0] raw (config option, may be wiped, allows promisc accounting).
[1] pre-routing (demasquerade, reverse NAT, redirect)
[2] input (packet filtering)
[3] forward (packet filtering)
[4] output (packet filtering, demasq, reverse NAT, redirect)
[5] post-routing (masquerade, de-reverse NAT)

  1. Each hook can be registered for by multiple modules. First in, first called.
  2. Can return NF_DROP, NF_ACCEPT or NF_USERSPACE.
  3. The next hook on that hook point called unless NF_DROP returned.
  4. Caching bitfield indicates what that hook examined, and if it changed the packet.
  5. nf_drop() call for registering packet drops (eg. in routing code).

Packet Filtering

  1. New filtering tool and extensible module called `ip_tables.o'; uses hooks 2, 3, and 4.
  2. Example modules: REJECT module (sends ICMP port unreachable and returns NF_DROP), and MAC module (compares MAC address).
  3. Loads whole tables instead of individual rules.
  4. Smaller than ipchains.
  5. Knows nothing about packet manipulation (eg. masquerading, NAT or redirection).

Masquerading/NAT

NAT: Network Address Translation NAPT: Network Address Port Translation Masquerading RNAT: Reverse NAT
  1. New NAT infrastructure uses hooks 1, 2, 4 and 5.
  2. Provides understanding of ICMP, TCP and UDP by default.
  3. Different "mapping" modules can be written, which modify how the mapping to a range of addresses is done
    1. masquerade
    2. redirect
    3. failover?
  4. UDP and TCP allow modules to provide extra handling for certain destination ports, eg. FTP, realaudio.
  5. An ordered (most-specific to least-specific) setup table is kept, which is manipulated by userspace. When a match is found in this table, the mapping type module is called to create a "binding".

Next