1. Netfilter Architecture

1.1 Why?

2.2: portforward, redirection, masquerading, filtering:

• Related, but close to the stack (fragile), and independent from each other.
• Needed an in-kernel packet snarfing framework: no more hard-coded kernel #ifdef hacks.

Netfilter is the framework.

1.2 The Hooks

Parts of the kernel can register with netfilter to see packets at various points in the stack (similar to old firewall.h hooks).

IPv4: PRE_ROUTING, LOCAL_IN, FORWARD, LOCAL_OUT, POST_ROUTING.

Each hook can alter packets, return NF_DROP, NF_ACCEPT, NF_QUEUE, NF_REPEAT or NF_STOLEN.

1.3 Other Protocols

Hooks have been inserted in the IPv6 and DecNET stacks as well.

IPv6: PRE_ROUTING, LOCAL_IN, FORWARD, LOCAL_OUT, POST_ROUTING.

DecNET: PRE_ROUTING, LOCAL_IN, FORWARD, LOCAL_OUT, POST_ROUTING, HELLO, ROUTE

1.4 On Top of Netfilter

Currently, four major subsystems exist on top of netfilter:

• The backwards-compatibility ipchains & ipfwadm +masq/redir modules.
• The `iptables' packet classification system.
• The connection-tracking system.
• The NAT system.

1.5 Summary

Linux 2.4's IP stack now has sufficient hooks to cleanly extend functionality for filtering, NAT and random hacks.